CVE-2015-5477
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
BIND DNS servers crash when they receive certain TKEY queries from remote attackers, causing the DNS service to stop working.
A remote attacker can trigger an assertion failure in ISC BIND 9.x (before 9.9.7-P2) and 9.10.x (before 9.10.2-P3) by sending crafted TKEY queries, leading to daemon termination and denial of service. No authentication or special privileges are required; the vulnerability is exploitable over the network.