Published: 29/04/2021 Updated: 03/05/2022

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

This vulnerability allows remote malicious users to execute arbitrary code on affected installations of ISC BIND. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of TKEY queries. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the "bind" user.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 9.0
debian debian linux 10.0
isc bind 9.11.7
isc bind 9.11.3
isc bind 9.11.6
isc bind 9.10.5
isc bind 9.11.5
isc bind 9.9.3
isc bind 9.10.7
isc bind 9.11.12
isc bind
isc bind 9.9.12
isc bind 9.9.13
isc bind 9.11.8
isc bind 9.11.21
isc bind 9.11.27
isc bind 9.11.29
isc bind 9.16.8
isc bind 9.16.11
isc bind 9.16.13
siemens sinec infrastructure network services
netapp cloud backup -
netapp active iq unified manager -
netapp aff_a250_firmware -
netapp aff_500f_firmware -
netapp h300s_firmware -
netapp h500s_firmware -
netapp h700s_firmware -
netapp h300e_firmware -
netapp h500e_firmware -
netapp h700e_firmware -
netapp h410s_firmware -

Debian Bug report logs - #987743 bind9: CVE-2021-25216 Package: src:bind9; Maintainer for src:bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 28 Apr 2021 20:48:04 UTC Severity: grave Tags: security, upstream Found in version bind9/1:91613-1 ...

Several vulnerabilities were discovered in BIND, a DNS server implementation CVE-2021-25214 Greg Kuechle discovered that a malformed incoming IXFR transfer could trigger an assertion failure in named, resulting in denial of service CVE-2021-25215 Siva Kakarla discovered that named could crash when a DNAME record placed in the ...

In BIND 950 -> 91129, 9120 -> 91613, and versions BIND 9113-S1 -> 91129-S1 and 9168-S1 -> 91613-S1 of BIND Supported Preview Edition, as well as release versions 9170 -> 9171 of the BIND 917 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG ...

Critical Infrastructure Sectors: Energy

oss-sec mailing list archives   By Date By Thread </form>    Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)  ...

send_vuln_pkgs_after_cvescan Tool for parse report from cvescan and send to syslog server or file download cvescan OR githubcom/qwerty1q2w/make_cvescan_bin Run cvescan - /snap/bin/cvescan --priority all --json > path_to_cvescan_report Run this tool - /cvescan_handler -o file -rp path_to_cvescan_report ###Output in /var/log/vulnerslog OR send to syslog - /cve

Apple patches iOS, macOS, iPadOS, watchOS, kitchen-sinkOS bugs said to be exploited in the wild

The Register • Iain Thomson in San Francisco • 04 May 2021

Plus: Micro-op CPU caches abused to leak data, and more

In Brief Apple on Monday patched security flaws in its software said to have been exploited in the wild by miscreants to hijack gear. WebKit, fixed in macOS Big Sur 11.3.1, can be tricked into executing arbitrary code by processing malicious web content – a bad webpage can take over the browser, in other words. "Apple is aware of a report that this issue may have been actively exploited," it said in its advisory. Specifically, there are two bugs: memory corruption flaw CVE-2021-30665, which wa...

CVE-2021-25216

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Mailing Lists

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect