PT-2021-3132 · Isc+6 · Bind+6

Michael Mcnally · Published 2021-04-28 · Updated 2026-01-19 · CVE-2021-25216

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BIND versions 9.5.0 through 9.11.29 BIND versions 9.12.0 through 9.16.13 BIND Supported Preview Edition versions 9.11.3-S1 through 9.11.29-S1 BIND Supported Preview Edition versions 9.16.8-S1 through 9.16.13-S1 BIND 9.17 development branch versions 9.17.0 through 9.17.1

Description The issue is related to a buffer overflow in the GSS-TSIG component of BIND servers. This can be exploited to trigger a server crash or achieve remote code execution, depending on the CPU architecture. The vulnerable code path is not exposed in the default configuration, but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options. GSS-TSIG is frequently used in networks where BIND is integrated with Samba or in mixed-server environments that combine BIND servers with Active Directory domain controllers.

Recommendations For versions 9.5.0 through 9.11.29, update to version 9.11.31 or later to fix the issue. For versions 9.12.0 through 9.16.13, update to version 9.16.15 or later to fix the issue. For BIND Supported Preview Edition versions 9.11.3-S1 through 9.11.29-S1, update to a version that includes the fix. For BIND Supported Preview Edition versions 9.16.8-S1 through 9.16.13-S1, update to a version that includes the fix. For BIND 9.17 development branch versions 9.17.0 through 9.17.1, update to version 9.17.12 or later to fix the issue. As a temporary workaround, consider disabling the GSS-TSIG feature until a patch is available.

Fix

RCE

Buffer Overflow

Assertion Failure

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-617

CWE-125

Related Identifiers

ALT-PU-2021-1752

ALT-PU-2021-1786

ALT-PU-2021-1836

BDU:2021-02773

CVE-2021-25216

DLA-2647-1

DSA-4909-1

MGASA-2021-0220

OPENSUSE-SU-2024:10650-1

SUSE-SU-2021:1469-1

SUSE-SU-2021:14714-1

SUSE-SU-2021_1469-1

SUSE-SU-2021_14714-1

USN-4929-1

USN-7739-1

ZDI-21-657

Affected Products

Alt Linux

Astra Linux

Bind

Bind Server

Linuxmint

Suse

Ubuntu

References · 92

• https://zerodayinitiative.com/advisories/ZDI-21-657 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-25216 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02773 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10650-1 · Vendor Advisory
• https://debian.org/security/2021/dsa-4909 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-25216 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4909-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0220 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:14714-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25216 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0114SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2647-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25214 · Vendor Advisory