Skip to content
OpenAdvisories
High USN-4929-1 3 CVEs

bind9 vulnerabilities

Published Apr 29, 2021 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Greg Kuechle discovered that Bind incorrectly handled certain incremental
zone updates. A remote attacker could possibly use this issue to cause Bind
to crash, resulting in a denial of service. (CVE-2021-25214)

Siva Kakarla discovered that Bind incorrectly handled certain DNAME
records. A remote attacker could possibly use this issue to cause Bind to
crash, resulting in a denial of service. (CVE-2021-25215)

It was discovered that Bind incorrectly handled GSSAPI security policy
negotiation. A remote attacker could use this issue to cause Bind to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2021-25216)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS bind9 1:9.10.3.dfsg.P4-8ubuntu1.19
Ubuntu · 18.04 LTS 18.04:LTS bind9 1:9.11.3+dfsg-1ubuntu1.15
Ubuntu · 20.04 LTS 20.04:LTS bind9 1:9.16.1-0ubuntu2.8

Vulnerabilities 3

  • High 8.1
    CVE-2021-25216 EPSS 83%

    A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

    In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • High 7.5
    CVE-2021-25215 EPSS 12%

    An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself

    In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version o…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2021-25214

    A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly

    In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vu…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2021-25214
  • report
    https://ubuntu.com/security/CVE-2021-25215
  • report
    https://ubuntu.com/security/CVE-2021-25216