ZeroDay Findings
Sign inSign up

Findings

CVE-2015-5477

ISC BIND Data Processing Errors Vulnerability

Published Jul 29, 2015 · updated Oct 9, 2026 · ISC BIND

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 29, 2015 · Catalog

    Detected

    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

  2. Oct 8, 2026 · CISA KEV

    Known exploited

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

  3. Oct 9, 2026 · Catalog

    Updated

    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

  4. Oct 11, 2026 · CISA KEV

    Remediation due

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA due date Oct 11, 2026

Affected

  • cpe debian/debian linux7.0
  • cpe fedoraproject/fedora21
  • cpe juniper/junosversion unspecified
  • cpe juniper/junos12.1
  • cpe juniper/junos12.1r
  • cpe juniper/junos12.1x44
  • cpe oracle/vm server3.2
  • cpe redhat/enterprise linux5.0
  • vendor ISC BINDversion unspecified

Sources

  • CISA KEVCVE-2015-5477

    ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

    cisa.gov
  • CVE.orgCVE-2015-5477

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2015-5477

    30-day exploitation probability 99.4%

    first.org
  • Exploit Database37721

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database37723

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesauxiliary_dos/dns/bind_tkey

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2015-5477

    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

    nvd.nist.gov

References