CVE-2015-5477 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2015-07-29

Added to CISA KEV: 2026-10-08 4089 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
IMMEDIATE: Upgrade ISC BIND to 9.9.7-P2 or later (for 9.9.x branch) or 9.10.2-P3 or later (for 9.10.x branch) — this is the ONLY effective mitigation; no configuration workaround exists
IMMEDIATE: Audit all systems for BIND version — check embedded BIND in Juniper, HP, NetApp, Oracle, and Apple devices in addition to Linux/Unix servers
CRITICAL: Apply vendor-specific patches for Juniper (JSA10718/JSA10783), HP (HPSBUX03400/03410/03511), NetApp, Oracle, and Apple OS X Server if using those platforms
MONITORING: Review DNS server logs for unexpected named process crashes or restarts — repeated crashes may indicate active exploitation attempts
MONITORING: Implement alerting on named service crashes and automatic service restart with rate limiting to reduce impact during exploitation attempts
NETWORK: Consider rate-limiting TKEY queries at the network perimeter as a temporary partial mitigation (though this does not fully prevent exploitation)
NETWORK: If running recursive resolvers, evaluate whether they need to be publicly internet-accessible or if ACLs limiting query sources are appropriate post-patch
DETECTION: Monitor network traffic for anomalous TKEY query patterns to port 53 — these are rare in normal operations and may indicate scanning or exploitation attempts
PRIORITY: This should be treated as CRITICAL priority given confirmed active exploitation, zero authentication requirement, and fundamental internet infrastructure impact — patch immediately
ARCHITECTURE: Consider deploying secondary/redundant DNS servers with different software (e.g., NSD, PowerDNS) as a resilience measure to prevent single points of failure

🔍 Web Intelligence (Kagi · 2026-10-08)

Summary

CVE-2015-5477 is a critical vulnerability in the ISC BIND 9 DNS server software caused by an error in the way the application handles TKEY queries. By sending a specially crafted packet, a remote, unauthenticated attacker can trigger a REQUIRE assertion failure, which forces the BIND process (`named`) to exit abruptly. This vulnerability is highly significant because the exploitation occurs early in the packet handling process, meaning that even servers with strict Access Control Lists (ACLs) or other configuration-based service limitations are fully exposed to the denial-of-service attack.

Exploitation

Active Exploitation: The vulnerability was actively exploited in the wild following its disclosure, with numerous reports of DNS servers being crashed globally ^[2].
Threat Actors: While widely abused for general disruption, specific threat actor attribution to persistent campaigns is less documented than the widespread opportunistic exploitation that occurred shortly after the vulnerability became public.
Exploit Availability: Proof-of-concept (PoC) code and exploit scripts were publicly available, making it trivial for attackers to target vulnerable infrastructure ^[2]^[4].
Attack Prerequisites:

* Network: The attack is performed remotely over the network, typically via UDP or TCP on port 53. * Authentication: No authentication is required to send the malicious packet. * User Interaction: No user interaction is required from the victim. * Bypassing Security: Traditional network-level security controls like ACLs generally fail to prevent the attack because the vulnerable code executes before these checks are enforced ^[1].

Affected Products & Patches

Affected Versions: BIND 9.1.0 through 9.9.7-P1, and BIND 9.10.2-P2 are vulnerable ^[1].
Patches: ISC released security patches to address this flaw. Administrators were advised to upgrade to BIND 9.9.7-P2 or later, or BIND 9.10.2-P3 or later ^[3].
Mitigations: Due to the nature of the vulnerability (processing occurring before security policy enforcement), there are no effective configuration-based workarounds; upgrading to a patched version is the only secure resolution ^[1].

Impact

Access & Capability: Successful exploitation results in an immediate and complete denial-of-service (DoS) condition, crashing the BIND service.
Business Risk: For internet-facing deployments, this vulnerability poses a severe threat to infrastructure availability. Because DNS is a foundational service for internet connectivity and application resolution, a successful crash of authoritative or recursive BIND servers can cause widespread outage for any services relying on those DNS records, leading to significant operational disruption and loss of service for clients.

Sources

CVE-2015-5477: An error in handling TKEY queries can ...
An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect ... CVE: CVE-2015-5477. Document version: 2.2.Impact: Both recursive and authoritative servers are vulnerable to this defect. Additionally, expos…
CVE-2015-5477 : named in ISC BIND 9.x before 9.9.7-P2 and...
Vulnerability Details : CVE-2015-5477. Public exploit exists! named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.Top countries where our scanners detected CVE-2015-5477. T…
CVE-2015-5477 - Exploits & Severity - Feedly
CVE info copied to clipboard. Summary. A vulnerability in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. Impact. This vulnerability can lead to a complete denial of service on…
CVE-2015-5477: Isc Bind — public exploit
Get the full picture for CVE-2015-5477 and every CVE in our database. Create a free account — no credit card required. Create Free Account Plain-language analysis Impact assessment and exploitation scenario in plain English Attack graph visualization Interactive attack path and kill chain mapping Ex…

🔴 CVE-2015-5477