CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

The Hacker News describes CVE-2015-5477 as "a reachable assertion vulnerability in ISC BIND"[1] that lets a remote attacker cause a denial of service through TKEY queries.According to the CVE record, as cited by cve-security.com, BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 let remote attackers trigger a REQUIRE assertion failure and daemon exit through TKEY queries.[2]The Hacker News reports that the KEV additions coincide with a joint advisory from Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S.[1] It adds that these operations target eight security vulnerabilities to gain initial access and siphon sensitive data.[1]The Hacker News quotes CISA's Chris Butera as saying that Chinese government-affiliated actors aim to disrupt "critical functions at a future time of their choosing."[1]The Hacker News also reports that federal agencies must apply the necessary patches or stop using the affected products by October 11, 2026.[1]When ISC disclosed the bug in 2015, its incident manager wrote on the bind-users mailing list that almost all unpatched BIND servers were potentially vulnerable.[3] He also wrote that "This bug is designated 'Critical' and it deserves that designation."[3]According to cve-security.com, Metasploit carries a module for the flaw, and Exploit-DB lists two exploits for it[2].