CVE-2015-5477: BIND (ISC)
Vulnerabilità già sfruttata in attacchi reali, punteggio 7,5 su 10, in BIND (ISC). Sfruttabile da remoto, via rete, senza credenziali, senza che nessuno faccia nulla.
- Gravità
- 7,5 su 10 (high)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Sfruttamento
- Sfruttata in attacchi reali (catalogo CISA KEV).
- Scadenza CISA
- Le agenzie federali USA devono correggerla entro il 11 ottobre 2026: un buon riferimento anche per voi.
- Tipo di difetto
- CWE-19
CWE-617 - Pubblicata
- 29 luglio 2015
Descrizione originale
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Fonti
- Scheda NVD
- kb.juniper.net/InfoCenter/index?page=content&id=JSA10718
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.html
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.html
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.html
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.html
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.html