Vulnerability Name:

CVE-2021-25216 (CCN-200935)

Assigned:2021-04-28
Published:2021-04-28
Updated:2022-05-03
Summary:In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. For servers that meet these conditions, the ISC SPNEGO implementation is vulnerable to various attacks, depending on the CPU architecture for which BIND was built: For named binaries compiled for 64-bit platforms, this flaw can be used to trigger a buffer over-read, leading to a server crash. For named binaries compiled for 32-bit platforms, this flaw can be used to trigger a server crash due to a buffer overflow and possibly also to achieve remote code execution. We have determined that standard SPNEGO implementations are available in the MIT and Heimdal Kerberos libraries, which support a broad range of operating systems, rendering the ISC implementation unnecessary and obsolete. Therefore, to reduce the attack surface for BIND users, we will be removing the ISC SPNEGO implementation in the April releases of BIND 9.11 and 9.16 (it had already been dropped from BIND 9.17). We would not normally remove something from a stable ESV (Extended Support Version) of BIND, but since system libraries can replace the ISC SPNEGO implementation, we have made an exception in this case for reasons of stability and security.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.1 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-125
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-25216

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216)

Source: CONFIRM
Type: Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: XF
Type: UNKNOWN
isc-bind-cve202125216-bo(200935)

Source: CCN
Type: ISC Web site
CVE-2021-25216: A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

Source: CONFIRM
Type: Not Applicable
https://kb.isc.org/v1/docs/cve-2021-25215

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210521-0006/

Source: DEBIAN
Type: Third Party Advisory
DSA-4909

Source: CCN
Type: IBM Security Bulletin 6575503 (Watson Speech Services Cartridge for Cloud Pak for Data)
A vulnerability in ISC BIND affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-25216)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2021-25216

Source: CCN
Type: ZDI-21-657
ISC BIND TKEY Query Integer Overflow Remote Code Execution Vulnerability

Source: MISC
Type: Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-657/

Vulnerable Configuration:Configuration 1:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.10.7:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.5:s6:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.12:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:*:*:*:*:-:*:*:* (Version >= 9.0.0 and < 9.11.31)
  • OR cpe:/a:isc:bind:9.9.12:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.9.13:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.27:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.11.29:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:*:*:*:*:-:*:*:* (Version >= 9.12.0 and < 9.16.15)
  • OR cpe:/a:isc:bind:9.16.8:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.16.11:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*
  • OR cpe:/a:isc:bind:*:*:*:*:-:*:*:* (Version >= 9.17.0 and < 9.17.12)

    • Configuration 3:
  • cpe:/a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* (Version < 1.0.1.1)

    • Configuration 4:
  • cpe:/a:netapp:cloud_backup:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*

    • Configuration 5:
  • cpe:/o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netapp:aff_a250:-:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netapp:aff_500f:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netapp:h300s:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netapp:h500s:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netapp:h700s:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netapp:h300e:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netapp:h500e:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netapp:h700e:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netapp:h410s:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:isc:bind:9.5:*:*:*:-:*:*:*
  • OR cpe:/a:isc:bind:9.12.0:*:*:*:*:*:*:*
  • OR cpe:/a:isc:bind:9.9.0:*:*:*:*:*:*:*
  • OR cpe:/a:isc:bind:9.11.0:*:*:*:*:*:*:*
  • OR cpe:/a:isc:bind:9.16.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7449
    P
    		bind-devel-9.16.6-150300.22.27.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7450
    P
    		bind-utils-9.16.38-150400.5.20.2 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3469
    P
    		davfs2-1.5.2-2.3 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95099
    P
    		bind-9.16.20-150400.3.6 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94506
    P
    		bind-devel-9.16.6-150300.22.16.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2876
    P
    		bind-devel-9.16.6-150300.22.16.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94507
    P
    		bind-utils-9.16.20-150400.3.6 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2877
    P
    		bind-utils-9.16.20-150400.3.6 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:112004
    P
    		bind-9.16.20-1.4 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:105563
    P
    		bind-9.16.20-1.4 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:56992
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:43173
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:29359
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:86552
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:82566
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:55182
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:31616
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:40042
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:84593
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:57439
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:44472
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:30072
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:87375
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:83279
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:55895
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:32088
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:41217
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:85633
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:57911
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:45647
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:30192
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:38090
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:83399
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:56015
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:32911
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:23568
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:86080
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:58734
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:51556
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:31169
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:38743
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:84136
    P
    		Security update for bind (Important)
    2021-05-04
    BACK
    debian debian linux 9.0
    debian debian linux 10.0
    isc bind 9.11.7 s1
    isc bind 9.11.3 s1
    isc bind 9.11.6 s1
    isc bind 9.10.5 s1
    isc bind 9.11.5 s5
    isc bind 9.11.5 s3
    isc bind 9.9.3 s1
    isc bind 9.10.7 s1
    isc bind 9.11.5 s6
    isc bind 9.11.12 s1
    isc bind *
    isc bind 9.9.12 s1
    isc bind 9.9.13 s1
    isc bind 9.11.8 s1
    isc bind 9.11.21 s1
    isc bind 9.11.27 s1
    isc bind 9.11.29 s1
    isc bind *
    isc bind 9.16.8 s1
    isc bind 9.16.11 s1
    isc bind 9.16.13 s1
    isc bind *
    siemens sinec infrastructure network services *
    netapp cloud backup -
    netapp active iq unified manager -
    netapp aff a250 firmware -
    netapp aff a250 -
    netapp aff 500f firmware -
    netapp aff 500f -
    netapp h300s firmware -
    netapp h300s -
    netapp h500s firmware -
    netapp h500s -
    netapp h700s firmware -
    netapp h700s -
    netapp h300e firmware -
    netapp h300e -
    netapp h500e firmware -
    netapp h500e -
    netapp h700e firmware -
    netapp h700e -
    netapp h410s firmware -
    netapp h410s -
    isc bind 9.5
    isc bind 9.12.0
    isc bind 9.9.0
    isc bind 9.11.0
    isc bind 9.16.0