CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

The Hacker News describes CVE-2015-5477 as a reachable assertion vulnerability in ISC BIND that could allow a remote attacker to cause a denial-of-service via TKEY queries[1].According to Innovation Network Design, a single packet can crash the named process[2]. The firm says ISC patched it in BIND 9.9.7 P2 and 9.10.2 P3 back in July[2] 2015.The Hacker News reports that the additions coincide with a joint advisory released by Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S.[1] The outlet says these operations have been found to target eight security vulnerabilities[1].The Hacker News also quotes CISA's Chris Butera, who said that "Chinese government-affiliated actors continue to position themselves within critical infrastructure networks"[1].According to The Hacker News, federal agencies are required to apply the necessary patches or discontinue their use by October 11, 2026.[1]The tracking site cve-security.com reports that Metasploit carries the auxiliary/dos/dns/bind_tkey module[3].Innovation Network Design advises that BIND should be running a supported 9.18 or 9.20 branch[2].