CVE-2015-8000: isc bind Improper Input Validation

CVSS: 5.0v2.0MediumModified

AliasesMGASA-2015-0481SUSE-SU-2015:2340-1SUSE-SU-2015:2341-1+9 more

Published 16-12-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-8000 is a medium (CVSS 5.0) Improper Input Validation vulnerability in isc bind. EPSS estimates a 54.69% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

54.69%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1

OPENSUSE-SU-2024:10467-1 RHSA-2016:0078 RHSA-2016:0079

Timeline

16-12-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

54.69%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 54.69% on 18-09-2026

18-09-202618-10-2026

EPSS score

54.69%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Redhat23 products

bind< 32:9.8.2-0.37.rc1.el6_7.5 | < 32:9.9.4-29.el7_2.1 | < 30:9.3.6-25.P1.el5_11.5
bind-chroot< 32:9.8.2-0.37.rc1.el6_7.5 | < 32:9.9.4-29.el7_2.1 | < 30:9.3.6-25.P1.el5_11.5
bind-debuginfo< 32:9.8.2-0.37.rc1.el6_7.5 | < 32:9.9.4-29.el7_2.1 | < 30:9.3.6-25.P1.el5_11.5
bind-devel< 32:9.8.2-0.37.rc1.el6_7.5 | < 32:9.9.4-29.el7_2.1 | < 30:9.3.6-25.P1.el5_11.5
bind-libbind-devel< 30:9.3.6-25.P1.el5_11.5

Show all 23

Suse18 products

bind&distro=SUSE Linux Enterprise Desktop 11 SP3< 9.9.6P1-0.19.1
bind&distro=SUSE Linux Enterprise Desktop 11 SP4< 9.9.6P1-0.19.1
bind&distro=SUSE Linux Enterprise Desktop 12< 9.9.6P1-28.6.1
bind&distro=SUSE Linux Enterprise Desktop 12 SP1< 9.9.6P1-32.1
bind&distro=SUSE Linux Enterprise Server 11 SP2-LTSS< 9.9.6P1-0.19.1

Show all 18

Oracle3 products

linuxEOL5.0 | 6 | 7
solarisEOL10 | 11.3
vm_server3.2

Debian1 product

bind9< 1:9.9.5.dfsg-12.1 | < 1:9.7.3.dfsg-1~squeeze18 | < 1:9.8.4.dfsg.P1-6+nmu2+deb7u8 | < 1:9.9.5.dfsg-9+deb8u4

Isc1 product

bind8.4.7 | 9.0 | 9.0.1 | 9.1 | 9.1.1 | 9.1.2 | 9.1.3 | 9.2 | 9.2.0 | 9.2.1 | 9.2.2 | 9.2.2:p3 | 9.2.3 | 9.2.4 | 9.2.5 | 9.2.6 | 9.2.7 | 9.3 | 9.3.0 | 9.3.1 | 9.3.2 | 9.3.3 | 9.4 | 9.4.0 | 9.4.0:rc1 | 9.4.1 | 9.4.2 | 9.4.3 | 9.4.3:rc1 | 9.5 | 9.5.0 | 9.5.0:rc1 | 9.5.1 | 9.5.1:rc1 | 9.5.1:rc2 | 9.5.2 | 9.5.2:rc1 | 9.5.3 | 9.5.3:rc1 | 9.6 | 9.6:r5_p1 | 9.6:r6_b1 | 9.6:r6_rc1 | 9.6:r6_rc2 | 9.6:r7_p1 | 9.6:r7_p2 | 9.6:r9_p1 | 9.6.0 | 9.6.0:p1 | 9.6.0:rc1 | 9.6.0:rc2 | 9.6.1 | 9.6.1:p1 | 9.6.1:p2 | 9.6.1:p3 | 9.6.1:rc1 | 9.6.2 | 9.6.2:rc1 | 9.6.3 | 9.6.3:rc1 | 9.7.0 | 9.7.0:b1 | 9.7.0:p1 | 9.7.0:p2 | 9.7.0:rc1 | 9.7.0:rc2 | 9.7.1 | 9.7.1:p1 | 9.7.1:p2 | 9.7.1:rc1 | 9.7.2 | 9.7.2:p1 | 9.7.2:p2 | 9.7.2:p3 | 9.7.2:rc1 | 9.7.3 | 9.7.3:b1 | 9.7.3:p1 | 9.7.3:rc1 | 9.7.4 | 9.7.4:b1 | 9.7.4:p1 | 9.7.4:rc1 | 9.7.5 | 9.7.5:b1 | 9.7.5:rc1 | 9.7.5:rc2 | 9.7.6 | 9.7.6:p1 | 9.7.6:p2 | 9.7.7 | 9.8.0 | 9.8.0:a1 | 9.8.0:b1 | 9.8.0:p1 | 9.8.0:p2 | 9.8.0:p4 | 9.8.0:rc1 | 9.8.1 | 9.8.1:b1 | 9.8.1:b2 | 9.8.1:b3 | 9.8.1:p1 | 9.8.1:rc1 | 9.8.2:b1 | 9.8.2:rc1 | 9.8.2:rc2 | 9.8.3 | 9.8.3:p1 | 9.8.3:p2 | 9.8.4 | 9.8.5 | 9.8.5:b1 | 9.8.5:b2 | 9.8.5:p1 | 9.8.5:p2 | 9.8.5:rc1 | 9.8.5:rc2 | 9.8.6:b1 | 9.8.6:rc1 | 9.8.6:rc2 | 9.9.0 | 9.9.0:a1 | 9.9.0:a2 | 9.9.0:a3 | 9.9.0:b1 | 9.9.0:b2 | 9.9.0:rc1 | 9.9.0:rc2 | 9.9.0:rc3 | 9.9.0:rc4 | 9.9.1 | 9.9.1:p1 | 9.9.1:p2 | 9.9.2 | 9.9.3 | 9.9.3:b1 | 9.9.3:b2 | 9.9.3:p1 | 9.9.3:p2 | 9.9.3:rc1 | 9.9.3:rc2 | 9.9.4:b1 | 9.9.5 | 9.9.6 | 9.9.6:p1 | 9.9.7:b1 | 9.9.7:p1 | 9.9.7:rc1 | 9.9.7:rc2 | 9.9.8 | 9.9.8:rc1 | 9.9.8:s1 | 9.10.0 | 9.10.1 | 9.10.1:p1 | 9.10.2:b1 | 9.10.2:p1 | 9.10.2:p2 | 9.10.2:p3 | 9.10.2:p4 | 9.10.2:rc1 | 9.10.3 | 9.10.3:rc1

Mageia1 product

bind< 9.10.3.P2-1.mga5

Ubuntu1 product

bind9< 1:9.9.5.dfsg-3ubuntu0.6

7 vendors · 48 products

References

55 links

www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlX Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=145680832702035&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/X Refsource CONFIRMPatch
blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/X Refsource CONFIRMPatch
lists.fedoraproject.org/pipermail/package-announce/2015-December/174145.htmlVendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/pipermail/package-announce/2015-December/174252.htmlVendor AdvisoryX Refsource FEDORA
kb.isc.org/article/AA-01438X Refsource CONFIRM
rhn.redhat.com/errata/RHSA-2016-0079.htmlVendor AdvisoryX Refsource REDHAT
lists.opensuse.org/opensuse-security-announce/2015-12/msg00036.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2015-12/msg00035.htmlVendor AdvisoryX Refsource SUSE

Show all 55 references

www.ubuntu.com/usn/USN-2837-1Vendor AdvisoryX Refsource UBUNTU
rhn.redhat.com/errata/RHSA-2015-2655.htmlVendor AdvisoryX Refsource REDHAT
lists.opensuse.org/opensuse-security-announce/2015-12/msg00027.htmlVendor AdvisoryX Refsource SUSE
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRMThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-December/174143.htmlVendor AdvisoryX Refsource FEDORA
kb.isc.org/article/AA-01380X Refsource CONFIRMVendor Advisory
www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.539966Vendor AdvisoryX Refsource SLACKWARE
www.securityfocus.com/bid/79349VDB EntryX Refsource BID
lists.opensuse.org/opensuse-security-announce/2015-12/msg00042.htmlVendor AdvisoryX Refsource SUSE
www.securitytracker.com/id/1034418VDB EntryX Refsource SECTRACK
lists.opensuse.org/opensuse-security-announce/2015-12/msg00034.htmlVendor AdvisoryX Refsource SUSE
packetstormsecurity.com/files/134882/FreeBSD-Security-Advisory-BIND-Denial-Of-Service.htmlX Refsource MISC
lists.fedoraproject.org/pipermail/package-announce/2015-December/174520.htmlVendor AdvisoryX Refsource FEDORA
kb.isc.org/article/AA-01317X Refsource CONFIRMVendor AdvisoryWEBARTICLE
h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04923105X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2015-12/msg00028.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2016-0078.htmlVendor AdvisoryX Refsource REDHAT
lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2015-2656.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2015-2658.htmlVendor AdvisoryX Refsource REDHAT
www.debian.org/security/2015/dsa-3420Vendor AdvisoryX Refsource DEBIAN
www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlX Refsource CONFIRMThird Party Advisory
advisories.mageia.org/MGASA-2015-0481.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=17339REPORT
www.suse.com/support/update/announcement/2015/suse-su-20152340-1/Advisory
bugzilla.suse.com/923281REPORT
bugzilla.suse.com/958861REPORT
www.suse.com/security/cve/CVE-2015-8000WEB
www.suse.com/support/update/announcement/2015/suse-su-20152341-1/Advisory
www.suse.com/support/update/announcement/2015/suse-su-20152359-1/Advisory
access.redhat.com/errata/RHSA-2015:2655Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1291176REPORT
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2655.jsonAdvisory
access.redhat.com/security/cve/CVE-2015-8000REPORT
www.cve.org/CVERecord?id=CVE-2015-8000AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2015-8000Advisory
access.redhat.com/errata/RHSA-2015:2656Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2656.jsonAdvisory
access.redhat.com/errata/RHSA-2015:2658Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2658.jsonAdvisory
ubuntu.com/security/CVE-2015-8000REPORT
kb.isc.org/article/AA-01317/0REPORT
ubuntu.com/security/notices/USN-2837-1Advisory
security-tracker.debian.org/tracker/CVE-2015-8000Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities