Vulnerability · Published Apr 29, 2021 · Assigned by isc
CVE-2021-25214A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly
Medium 6.5
In plain English
A medium-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.4% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bind | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-chroot | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-devel | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-libs | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-libs-lite | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-license | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-lite-devel | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-pkcs11 | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-pkcs11-devel | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-pkcs11-libs | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-pkcs11-utils | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-sdb | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-sdb-chroot | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | bind-utils | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| AlmaLinux:8 | python3-bind | 32:9.11.26-6.el8 | ALSA-2021:4384 |
| Alpine:v3.20 | bind | 9.16.15-r0 | ALPINE-CVE-2021-25214 |
| Alpine:v3.21 | bind | 9.16.15-r0 | ALPINE-CVE-2021-25214 |
| Alpine:v3.22 | bind | 9.16.15-r0 | ALPINE-CVE-2021-25214 |
| Alpine:v3.23 | bind | 9.16.15-r0 | ALPINE-CVE-2021-25214 |
| Alpine:v3.24 | bind | 9.16.15-r0 | ALPINE-CVE-2021-25214 |
| Debian:12 | bind9 | 1:9.16.15-1 | DEBIAN-CVE-2021-25214 |
| Debian:13 | bind9 | 1:9.16.15-1 | DEBIAN-CVE-2021-25214 |
| Debian:14 | bind9 | 1:9.16.15-1 | DEBIAN-CVE-2021-25214 |
| Rocky Linux:8 | bind | 2:9.11.26-6.el8 | RLSA-2021:4384 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ISC | BIND9 | Open Source Branch 9.8 9.8.5 through 9.8.8Open Source Branches 9.9 through 9.11 9.9.3 through versions before 9.11.30Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1Development Branch 9.17 9.17.0 through versiosn before 9.17.12 |
References
- https://kb.isc.org/v1/docs/cve-2021-25214 x_refsource_CONFIRM
- [oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list, x_refsource_MLIST
- [oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list, x_refsource_MLIST
- [oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list, x_refsource_MLIST
- [oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list, x_refsource_MLIST
- DSA-4909 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update mailing-list, x_refsource_MLIST
- FEDORA-2021-ace61cbee1 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-47f23870ec vendor-advisory, x_refsource_FEDORA
- https://security.netapp.com/advisory/ntap-20210521-0006/ x_refsource_CONFIRM
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf x_refsource_CONFIRM