PT-2025-22347 · Isc+3 · Bind 9+3

Published 2025-05-21 · Updated 2025-06-01 · CVE-2025-40775

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.20.0 through 9.20.8 BIND 9 versions 9.21.0 through 9.21.7

Description When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue can be exploited to perform a denial of service. A remote attacker could possibly use this issue to cause BIND to crash, resulting in a denial of service.

Recommendations To resolve the issue for BIND 9 versions 9.20.0 through 9.20.8, update to version 9.20.9 or later. To resolve the issue for BIND 9 versions 9.21.0 through 9.21.7, update to version 9.21.8 or later. As a temporary workaround, consider restricting access to the TSIG validation function until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-232

Related Identifiers

AZL-61972

CVE-2025-40775

OPENSUSE-SU-2025:15156-1

SUSE-SU-2025:01787-1

SUSE-SU-2025_01787-1

USN-7526-1

Affected Products

Bind 9

Debian

Suse

Ubuntu

References · 40

• https://ubuntu.com/security/notices/USN-7526-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-40775 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15156-1 · Vendor Advisory
• https://kb.isc.org/docs/cve-2025-40775 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40775 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-40775 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-40775 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-40775 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7526-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01787-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61972 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40775 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40775 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-40775 · Vendor Advisory