Vulnerability Details : CVE-2014-8500
ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.
Vulnerability category: Denial of service
Products affected by CVE-2014-8500
- cpe:2.3:a:isc:bind:9.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.5:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.9.5:*:*:*:*:*:*:*
Threat overview for CVE-2014-8500
Top countries where our scanners detected CVE-2014-8500
Top open port discovered on systems with this issue
53
IPs affected by CVE-2014-8500 196,934
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2014-8500!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2014-8500
83.49%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-8500
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST |
CWE ids for CVE-2014-8500
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-8500
-
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00017.html
[security-announce] SUSE-SU-2015:0096-1: important: Security update for
-
http://marc.info/?l=bugtraq&m=144000632319155&w=2
'[security bulletin] HPSBUX03400 SSRT102211 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS' - MARC
-
http://www.kb.cert.org/vuls/id/264212
VU#264212 - Recursive DNS resolver implementations may follow referrals infinitelyThird Party Advisory;US Government Resource
-
http://secunia.com/advisories/62122
Sign in
-
http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html
Page introuvable – CERT-FRVendor Advisory
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10676
Juniper Networks - 2015-04 Security Bulletin: SRX Series: ISC BIND vulnerability denial of service in delegation handling (CVE-2014-8500)
-
http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
Apple - Lists.apple.com
-
http://rhn.redhat.com/errata/RHSA-2016-0078.html
RHSA-2016:0078 - Security Advisory - Red Hat Customer Portal
-
https://kb.isc.org/article/AA-01216/
CVE-2014-8500: A Defect in Delegation Handling Can Be Exploited to Crash BIND - Affecting Only Obsolete BranchesVendor Advisory
-
http://marc.info/?l=bugtraq&m=142180687100892&w=2
'[security bulletin] HPSBUX03235 SSRT101750 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS' - MARC
-
http://securitytracker.com/id?1031311
ISC BIND Resolver Resource Consumption Flaw Lets Remote Users Deny Service - SecurityTracker
-
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
Oracle Bulletin Board Update - January 2015
-
https://support.apple.com/HT205219
About the security content of OS X Server v5.0.3 - Apple Support
-
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-002.txt.asc
-
http://www.mandriva.com/security/advisories?name=MDVSA-2015:165
mandriva.com
-
http://ubuntu.com/usn/usn-2437-1
USN-2437-1: Bind vulnerability | Ubuntu security noticesPatch;Vendor Advisory
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016
-
https://security.netapp.com/advisory/ntap-20190730-0002/
December 2014 ISC BIND Vulnerabilities in NetApp Products | NetApp Product Security
-
http://lists.opensuse.org/opensuse-updates/2015-07/msg00038.html
openSUSE-SU-2015:1250-1: moderate: Security update for bind
-
http://advisories.mageia.org/MGASA-2014-0524.html
Mageia Advisory: MGASA-2014-0524 - Updated bind packages fix CVE-2014-8500
-
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00013.html
[security-announce] SUSE-SU-2015:0488-1: important: Security update for
-
http://www.debian.org/security/2014/dsa-3094
Debian -- Security Information -- DSA-3094-1 bind9Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00001.html
[security-announce] SUSE-SU-2015:0011-1: important: Security update for
-
http://security.gentoo.org/glsa/glsa-201502-03.xml
BIND: Multiple Vulnerabilities (GLSA 201502-03) — Gentoo security
-
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00009.html
[security-announce] SUSE-SU-2015:0480-1: important: Security update for
-
http://www.securityfocus.com/bid/71590
ISC BIND CVE-2014-8500 Remote Denial of Service Vulnerability
-
http://secunia.com/advisories/62064
Sign in
Jump to