ISC BIND CVE-2015-5477: old flaw, active attacks

ISC BIND CVE-2015-5477: old flaw, active attacks

What CVE-2015-5477 is and who it affectsCVE-2015-5477 is a data processing error in ISC BIND, the DNS server software that resolves names for a large...

What CVE-2015-5477 is and who it affects

CVE-2015-5477 is a data processing error in ISC BIND, the DNS server software that resolves names for a large share of the internet. According to the National Vulnerability Database (NVD) of NIST, the flaw affects BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3. A remote attacker can send specially crafted TKEY queries and trigger a REQUIRE assertion failure that makes the named daemon exit, so the server stops answering.

Server rack in a small office with a loose cable and a pile of envelopes blocking its front grille

The NVD entry also lists Juniper Junos releases that bundle the affected BIND code, including 12.1 branches and versions from 13.1 up to, but not including, 13.2, plus a long tail of specific builds. In practice, the risk is not limited to organisations that installed BIND on purpose: it also reaches appliances and routers that embed it, which is exactly the kind of asset a small IT team tends to forget.

Severity is CVSS 3.1 7.5 (HIGH), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Read it plainly: no credentials needed, no user interaction, reachable over the network, and the only impact is availability. It is a serious denial-of-service flaw, not a critical one, and the NVD published it on 29 July 2015. The weakness classes are CWE-19 and CWE-617.

Why an eleven-year-old bug is urgent again

On 8 October 2026, CISA added CVE-2015-5477 to its Known Exploited Vulnerabilities (KEV) catalogue, which means there is confirmed evidence of exploitation in real attacks. The US federal deadline to remediate was set at 11 October 2026, three days later. CISA's instruction is to apply mitigations in line with the vendor's instructions and its BOD 26-04 guidance on risk-based security updates, and to discontinue use of the product where no mitigation is available.

The material does not record this CVE as used in ransomware campaigns, and it does not describe any specific exploit. What it does confirm is that attackers are using it. For a business in Lleida, Barcelona, Tarragona or Girona, the lesson is uncomfortable but simple: a DNS server that falls over takes email, e-commerce checkout, internal applications and VPN name resolution with it. An outage of that kind is a commercial problem, not just a technical one.

What to do today

  • Inventory your DNS. Check whether you run BIND, and in which version, on your own servers, on virtual machines and inside any appliance or router. Include the secondary and hidden servers nobody looks at.
  • Compare against the affected ranges. Anything in BIND 9.x before 9.9.7-P2 or 9.10.x before 9.10.2-P3 needs action. For Junos, check the Juniper advisory JSA10718 against your exact release.
  • Apply the fix from the vendor advisory. ISC documents the patch in article AA-01272 and Juniper publishes its own mitigation. If a component cannot be updated, follow the vendor's mitigation or stop exposing it; do not improvise a fix.
  • Look for signs of intrusion. Search logs for unexpected TKEY queries and for named restarts or assertion failures that nobody scheduled. Repeated crashes without explanation are a signal, not bad luck.
  • Reduce internet exposure. A DNS resolver should answer your clients, not the whole internet. Restrict recursion to known networks, close port 53 where it is not needed, and keep management interfaces off the public internet.

Also treat this as a reminder about security patches in general: old software does not become safe because it is old. Attackers keep tooling for known flaws precisely because so many systems are never updated.

How a cybersecurity team can help

Stories like this one rarely fail because the patch is hard. They fail because nobody knows the asset exists. That is where an external team earns its keep: a security audit and pentesting exercise maps what is actually exposed, hardening closes the gaps that audits reveal, and continuous monitoring and incident response catches the crash, the strange query or the unauthorised change before it becomes an outage.

For SMEs and online shops running WordPress, PrestaShop or Joomla, the same discipline applies to the CMS and its plugins: timely updates, controlled access and a recovery plan. And when a site has already been compromised, the priority is a clean repair and a proper review of how the attacker got in. At ALMC we work with companies across Catalonia on exactly this: finding vulnerabilities before someone else does, and keeping the patching routine alive after the audit report is filed.

Related

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.