CyberSecBulletin
CVE-2015-5477Exploited in the wildNVD status: Analyzed

ISC BIND Data Processing Errors

Published Updated By the CyberSecBulletin desk

CVE-2015-5477 is a high-severity vulnerability in Junos from Juniper Networks, with a CVSS 2.0 base score of 7.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 12.1, 13.2 as the first without the flaw, so updating Junos to one of those releases or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on October 8, 2026, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update Junos to 12.1 or 13.2, whichever matches your release line, or a later version.
  2. Update Vcx to 9.8.18 or a later version.
  3. Update Bind to 9.9.7 or 9.10.2, whichever matches your release line, or a later version.
  4. CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Juniper NetworksJunosbefore 12.1; 13.1 up to, but not including, 13.2; 12.1; 12.1r; 12.1x44; 12.1x45; 12.1x46; 12.1x47; and 13 more ranges12.1, 13.2
Fedora ProjectFedora21; 22Not stated
Red HatEnterprise Linux5.0; 6.0; 7.0Not stated
Red HatEnterprise Linux AUS6.4; 6.5; 6.6Not stated
DebianDebian Linux7.0; 8.0Not stated
OracleVM Server3.2Not stated
OracleSolaris10; 11.2Not stated
HPHp-ux11.11; 11.23; 11.31Not stated
CanonicalUbuntu Linux12.04Not stated
NetAppClustered Data OntapNot specified in the recordNot stated
AppleOS X Server4.1.5Not stated
Hewlett Packard EnterpriseDNS9.2.3; 9.3Not stated
HPOpenvms5.7Not stated
Hewlett Packard EnterpriseVcxbefore 9.8.189.8.18
SUSELinux Enterprise Debuginfo11Not stated
openSUSEEvergreen11.4Not stated
openSUSEOpensuse13.1; 13.2Not stated
SUSELinux Enterprise Desktop11; 12Not stated
SUSELinux Enterprise Server10; 11; 12Not stated
SUSELinux Enterprise Software Development Kit11; 12Not stated
ISCBind9.1.0 up to, but not including, 9.9.7; 9.10.0 up to, but not including, 9.10.2; 9.10.29.9.7, 9.10.2

Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Access vector
NetworkCan be exploited remotely over a network.
Access complexity
LowNo special conditions are needed.
Authentication
NoneNo login is needed.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
CompleteThe system can be shut down completely.

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighCISA (ADP)
CVSS 2.07.8HighNVD

Official description

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
  4. Deadline for US federal agencies to remediate, set by CISA.
  5. Record last changed materially (score, affected products, status or references).

References

Patches and release notes

Third-party and government advisories

Technical write-ups (may include proof of concept)

Other vulnerabilities in Junos

All Junos vulnerabilities

Spotted an error? Tell us.