CVE-2015-8000: Input Validation
Published Dec 16, 2015
·Updated
db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.
Affected Software
170 affected components
Oracle Linux=5.0
Oracle Linux=6
Oracle Linux=7
Oracle Solaris=10
Oracle Solaris=11.3
Oracle VM Server=3.2
ISC BIND=8.4.7
ISC BIND=9.0
ISC BIND=9.0.1
ISC BIND=9.1
ISC BIND=9.1.1
ISC BIND=9.1.2
ISC BIND=9.1.3
ISC BIND=9.2
ISC BIND=9.2.0
ISC BIND=9.2.1
ISC BIND=9.2.2
ISC BIND=9.2.2-p3
ISC BIND=9.2.3
ISC BIND=9.2.4
ISC BIND=9.2.5
ISC BIND=9.2.6
ISC BIND=9.2.7
ISC BIND=9.3
ISC BIND=9.3.0
ISC BIND=9.3.1
ISC BIND=9.3.2
ISC BIND=9.3.3
ISC BIND=9.4
ISC BIND=9.4.0
ISC BIND=9.4.0-rc1
ISC BIND=9.4.1
ISC BIND=9.4.2
ISC BIND=9.4.3
ISC BIND=9.4.3-rc1
ISC BIND=9.5
ISC BIND=9.5.0
ISC BIND=9.5.0-rc1
ISC BIND=9.5.1
ISC BIND=9.5.1-rc1
ISC BIND=9.5.1-rc2
ISC BIND=9.5.2
ISC BIND=9.5.2-rc1
ISC BIND=9.5.3
ISC BIND=9.5.3-rc1
ISC BIND=9.6
ISC BIND=9.6-r5_p1
ISC BIND=9.6-r6_b1
ISC BIND=9.6-r6_rc1
ISC BIND=9.6-r6_rc2
ISC BIND=9.6-r7_p1
ISC BIND=9.6-r7_p2
ISC BIND=9.6-r9_p1
ISC BIND=9.6.0
ISC BIND=9.6.0-p1
ISC BIND=9.6.0-rc1
ISC BIND=9.6.0-rc2
ISC BIND=9.6.1
ISC BIND=9.6.1-p1
ISC BIND=9.6.1-p2
ISC BIND=9.6.1-p3
ISC BIND=9.6.1-rc1
ISC BIND=9.6.2
ISC BIND=9.6.2-rc1
ISC BIND=9.6.3
ISC BIND=9.6.3-rc1
ISC BIND=9.7.0
ISC BIND=9.7.0-b1
ISC BIND=9.7.0-p1
ISC BIND=9.7.0-p2
ISC BIND=9.7.0-rc1
ISC BIND=9.7.0-rc2
ISC BIND=9.7.1
ISC BIND=9.7.1-p1
ISC BIND=9.7.1-p2
ISC BIND=9.7.1-rc1
ISC BIND=9.7.2
ISC BIND=9.7.2-p1
ISC BIND=9.7.2-p2
ISC BIND=9.7.2-p3
ISC BIND=9.7.2-rc1
ISC BIND=9.7.3
ISC BIND=9.7.3-b1
ISC BIND=9.7.3-p1
ISC BIND=9.7.3-rc1
ISC BIND=9.7.4
ISC BIND=9.7.4-b1
ISC BIND=9.7.4-p1
ISC BIND=9.7.4-rc1
ISC BIND=9.7.5
ISC BIND=9.7.5-b1
ISC BIND=9.7.5-rc1
ISC BIND=9.7.5-rc2
ISC BIND=9.7.6
ISC BIND=9.7.6-p1
ISC BIND=9.7.6-p2
ISC BIND=9.7.7
ISC BIND=9.8.0
ISC BIND=9.8.0-a1
ISC BIND=9.8.0-b1
ISC BIND=9.8.0-p1
ISC BIND=9.8.0-p2
ISC BIND=9.8.0-p4
ISC BIND=9.8.0-rc1
ISC BIND=9.8.1
ISC BIND=9.8.1-b1
ISC BIND=9.8.1-b2
ISC BIND=9.8.1-b3
ISC BIND=9.8.1-p1
ISC BIND=9.8.1-rc1
ISC BIND=9.8.2-b1
ISC BIND=9.8.2-rc1
ISC BIND=9.8.2-rc2
ISC BIND=9.8.3
ISC BIND=9.8.3-p1
ISC BIND=9.8.3-p2
ISC BIND=9.8.4
ISC BIND=9.8.5
ISC BIND=9.8.5-b1
ISC BIND=9.8.5-b2
ISC BIND=9.8.5-p1
ISC BIND=9.8.5-p2
ISC BIND=9.8.5-rc1
ISC BIND=9.8.5-rc2
ISC BIND=9.8.6-b1
ISC BIND=9.8.6-rc1
ISC BIND=9.8.6-rc2
ISC BIND=9.9.0
ISC BIND=9.9.0-a1
ISC BIND=9.9.0-a2
ISC BIND=9.9.0-a3
ISC BIND=9.9.0-b1
ISC BIND=9.9.0-b2
ISC BIND=9.9.0-rc1
ISC BIND=9.9.0-rc2
ISC BIND=9.9.0-rc3
ISC BIND=9.9.0-rc4
ISC BIND=9.9.1
ISC BIND=9.9.1-p1
ISC BIND=9.9.1-p2
ISC BIND=9.9.2
ISC BIND=9.9.3
ISC BIND=9.9.3-b1
ISC BIND=9.9.3-b2
ISC BIND=9.9.3-p1
ISC BIND=9.9.3-p2
ISC BIND=9.9.3-rc1
ISC BIND=9.9.3-rc2
ISC BIND=9.9.4-b1
ISC BIND=9.9.5
ISC BIND=9.9.6
ISC BIND=9.9.6-p1
ISC BIND=9.9.7-b1
ISC BIND=9.9.7-p1
ISC BIND=9.9.7-rc1
ISC BIND=9.9.7-rc2
ISC BIND=9.9.8
ISC BIND=9.9.8-rc1
ISC BIND=9.9.8-s1
ISC BIND=9.10.0
ISC BIND=9.10.1
ISC BIND=9.10.1-p1
ISC BIND=9.10.2-b1
ISC BIND=9.10.2-p1
ISC BIND=9.10.2-p2
ISC BIND=9.10.2-p3
ISC BIND=9.10.2-p4
ISC BIND=9.10.2-rc1
ISC BIND=9.10.3
ISC BIND=9.10.3-rc1
Remediation
Event History
Dec 16, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-8000?
CVE-2015-8000 has been classified as a high severity vulnerability due to its potential to cause denial of service.
2
How do I fix CVE-2015-8000?
To fix CVE-2015-8000, you should upgrade to ISC BIND version 9.9.8-P2 or later, or 9.10.3-P2 or later.
3
What type of vulnerability is CVE-2015-8000?
CVE-2015-8000 is a denial of service vulnerability that allows remote attackers to crash the BIND daemon.
4
Which software versions are affected by CVE-2015-8000?
The affected versions include ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2.
5
What are the consequences of not addressing CVE-2015-8000?
Failing to address CVE-2015-8000 can lead to a denial of service condition, causing the BIND DNS service to become unavailable.