Vulnerability Details : CVE-2015-4620
name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.
Vulnerability category: Denial of service
Threat overview for CVE-2015-4620
Top countries where our scanners detected CVE-2015-4620
Top open port discovered on systems with this issue
53
IPs affected by CVE-2015-4620 183,359
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2015-4620!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2015-4620
Probability of exploitation activity in the next 30 days: 15.65%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 95 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-4620
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST |
CWE ids for CVE-2015-4620
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-4620
-
https://kb.isc.org/article/AA-01306
404 Page not found
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162286.html
[SECURITY] Fedora 21 Update: bind-9.9.6-9.P1.fc21
-
https://kb.isc.org/article/AA-01307
404 Page not found
-
https://kb.isc.org/article/AA-01438
404 Page not found
-
https://security.gentoo.org/glsa/201510-01
BIND: Denial of Service (GLSA 201510-01) — Gentoo security
-
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html
[security-announce] openSUSE-SU-2015:1326-1: important: Security update
-
http://www.ubuntu.com/usn/USN-2669-1
USN-2669-1: Bind vulnerability | Ubuntu security notices
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162040.html
[SECURITY] Fedora 22 Update: bind-9.10.2-3.P2.fc22
-
http://marc.info/?l=bugtraq&m=143740940810833&w=2
'[security bulletin] HPSBUX03379 SSRT101976 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS' - MARC
-
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00013.html
[security-announce] SUSE-SU-2015:1205-1: important: Security update for
-
https://kb.isc.org/article/AA-01267
CVE-2015-4620: Specially Constructed Zone Data Can Cause a Resolver to Crash when Validating - Affecting Only Obsolete BranchesVendor Advisory
-
http://www.securityfocus.com/bid/75588
ISC BIND 'isselfsigned()' Function Remote Denial of Service Vulnerability
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10124
-
https://kb.juniper.net/JSA10783
Juniper Networks - 2017-04 Security Bulletin: Multiple Vulnerabilities in NorthStar Controller Application before version 2.1.0 Service Pack 1.
-
http://rhn.redhat.com/errata/RHSA-2015-1471.html
RHSA-2015:1471 - Security Advisory - Red Hat Customer Portal
-
http://www.securitytracker.com/id/1032799
ISC BIND DNSSEC Validation Flaw Lets Remote Users Deny Service in Certain Cases - SecurityTracker
-
https://security.netapp.com/advisory/ntap-20190903-0003/
CVE-2015-4620 ISC Bind Vulnerability in NetApp Products | NetApp Product Security
-
http://rhn.redhat.com/errata/RHSA-2015-1443.html
RHSA-2015:1443 - Security Advisory - Red Hat Customer Portal
-
https://kb.isc.org/article/AA-01305
404 Page not found
-
http://www.debian.org/security/2015/dsa-3304
Debian -- Security Information -- DSA-3304-1 bind9
-
http://lists.opensuse.org/opensuse-updates/2015-07/msg00038.html
openSUSE-SU-2015:1250-1: moderate: Security update for bind
Products affected by CVE-2015-4620
- cpe:2.3:a:isc:bind:9.7.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.0:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.0:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.10.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.10.1:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.10.2:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.10.2:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.1:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.2:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.2:p2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.1:p2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.0:p2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.5:rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.3:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.6:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.4:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.5:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.3:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.6:p2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.4:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.2:p3:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.0:a1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.0:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.0:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.0:p2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.1:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:a3:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:a2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.0:p4:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:a1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.1:b3:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.1:b2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.1:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:b2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.3:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.2:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.1:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.1:p2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.3:p2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.3:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.5:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.3:b2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.3:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.3:rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.5:b2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.5:rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.6:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.5:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.5:p2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.4:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.3:p2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.6:rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.6:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.7:b1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.7:rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.7:rc1:*:*:*:*:*:*