CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

According to The Hacker News, CVE-2015-5477 is "a reachable assertion vulnerability in ISC BIND that could allow a remote attacker to cause a denial-of-service via TKEY queries."[1]The Hacker News reports that the KEV additions coincide with a joint advisory released by Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S.[1]The outlet adds that federal agencies are required to apply the necessary patches or discontinue their use by October 11, 2026.[1]Red Hat's advisory says a remote attacker could crash named "via a specially crafted DNS request packet."[2] Red Hat also notes that "the BIND TKEY functionality is unrelated to DNSSEC."[2]At the time of disclosure in 2015, ISC's security incident manager wrote on the bind-users mailing list that "almost all unpatched BIND servers are potentially vulnerable."[3] He described the bug as "designated 'Critical' and it deserves that designation."[3]Innovation Network Design reports that ISC patched it in BIND 9.9.7 P2 and 9.10.2 P3 back in July of that year.[4] Its analyst advises that "BIND should be running a supported 9.18 or 9.20 branch."[4]According to cve-security.com, Metasploit carries the auxiliary/dos/dns/bind_tkey module[5], and public proof-of-concept code for the flaw is also available.