ZeroDayAlert

CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

ISC BIND Added to KEV 2026-10-08 Federal due 2026-10-11 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

ISC BIND DNS servers are affected by a data processing flaw triggered by TKEY (TSIG Key Establishment) queries. The vulnerability allows remote attackers to crash the BIND process, causing denial of service. The record does not specify which versions of BIND are vulnerable, nor does it name a patch version; you will need to cross-reference your deployment against ISC's advisory materials.

How to check whether this touches you

  • Inventory: Do you run ISC BIND as a DNS resolver or authoritative nameserver, whether on-premises or in a managed cloud service?
  • Network exposure: Can untrusted clients send DNS queries to your BIND instances? Check whether port 53 (UDP and TCP) is reachable from the internet or from untrusted network segments.
  • Version check: Query your BIND version using named -v or equivalent. Version fingerprinting is a signal of potential exposure; backported security patches may exist in your distribution's packages even if the main BIND release number appears older.

What to do

  1. Obtain ISC's BIND security advisory and patch guidance immediately. Cross-reference the affected version ranges against your deployed instances.
  2. If you cannot patch immediately, restrict TKEY query access at the firewall or via BIND's access control lists (ACLs) to only trusted clients, or disable TSIG key establishment if your deployment does not require it.
  3. Ensure that process monitoring and restart automation are in place, so that a crash is detected and the service recovers quickly.
  4. Enable and retain DNS query logging; configure log rotation to preserve at least 30 days of history. Escalate to your change advisory board if your environment is customer-facing or regulated.
  5. Apply patches on a scheduled maintenance window according to CISA BOD 26-04 guidelines (see CISA's published timeline). If patches are unavailable and mitigation is not feasible, plan discontinuation of the service.

If you find you were exposed

BIND crashes and denial-of-service events may not leave obvious forensic artefacts if the process was simply restarted. Review DNS query logs and system process logs for unexpected termination events, particularly any clustering around times when external queries were high or unusual. If you retain netflow or packet capture data, search for TKEY query patterns from external sources prior to any observed outages. Log retention is typically your limiting factor; begin backward searching from any known incident date.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2015-5477 is being exploited. It cannot tell you whether BIND is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →