CVE-2021-25214 A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly
A remote attacker can cause the BIND DNS server to crash by sending a malformed IXFR request, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-25214?
CVE-2021-25214 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 29 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.
Weakness: CWE-617
Which versions are affected by CVE-2021-25214?
It affects 15 products.
Linux distribution packages (40)
bind AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-chroot AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-devel AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-libs AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-libs-lite AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-license AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-lite-devel AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-pkcs11 AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-pkcs11-devel AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-pkcs11-libs AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-pkcs11-utils AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-sdb AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-sdb-chroot AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind-utils AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
python3-bind AlmaLinux:8 | All versions | 32:9.11.26-6.el8 |
bind Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-chroot Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-debuginfo Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-devel Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-export-devel Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-export-libs Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-libs Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-libs-lite Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-license Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-lite-devel Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-pkcs11 Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-pkcs11-devel Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-pkcs11-libs Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-pkcs11-utils Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-sdb Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-sdb-chroot Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-utils Red Hat:enterprise_linux:7::client | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind Red Hat:enterprise_linux:7::computenode | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-chroot Red Hat:enterprise_linux:7::computenode | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-devel Red Hat:enterprise_linux:7::computenode | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-export-devel Red Hat:enterprise_linux:7::computenode | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-lite-devel Red Hat:enterprise_linux:7::computenode | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-pkcs11 Red Hat:enterprise_linux:7::computenode | All versions | 32:9.11.4-26.P2.el7_9.7 |
bind-pkcs11-devel Red Hat:enterprise_linux:7::computenode | All versions | 32:9.11.4-26.P2.el7_9.7 |
Products include Debian Debian Linux, Fedoraproject Fedora, Isc Bind, Netapp Active Iq Unified Manager, Netapp Aff 500f Firmware, Netapp Aff A250 Firmware and 9 more.
How do I fix CVE-2021-25214?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-25214 being exploited?
There is no known exploitation of CVE-2021-25214 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-25214, ALSA-2021:4384, CLSA-2022-1643212135, DEBIAN-CVE-2021-25214, GHSA-pqmv-mqwc-wmr3, MGASA-2021-0275 and 4 more.