CVE-2015-5477 in juniper junos
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
Affected software: juniper junos, fedoraproject fedora, redhat enterprise linux, redhat enterprise linux aus, debian linux, oracle vm server, oracle solaris, hp-ux, canonical ubuntu linux, netapp clustered data ontap
Scores
- CVSS: 7.5 (high)
- EPSS: 99.58% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-10-08
- Published: 2015-07-29
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Update ISC BIND to 9.9.7-P2, 9.10.2-P3 or a supported release (CVE-2015-5477)
Patch or upgrade. Update BIND (named) to 9.9.7-P2, 9.10.2-P3 or any later supported release, or install your distribution's security update. A single TKEY query can otherwise crash named.
Applies to: ISC BIND 9.1.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2, and products that embed them.
- Check the version with 'named -v' on every DNS server, and on appliances that embed BIND (such as Junos and older Linux distributions).
- Install the distribution update (for example 'dnf update bind' or 'apt-get install --only-upgrade bind9'), or move to a supported BIND 9.18 or later release.
- Restart named and check 'named -v' again.
- On Juniper devices, install the Junos release from the Juniper bulletin.
- Replace BIND 9.9 and 9.10 installations: they are long out of support.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.