CVE-2014-8500

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 59.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-12-11 · updated 2026-06-17
Weakness: CWE-399

Description

ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.

Affected products

ISC BIND: 9.0, 9.0.1, 9.1, 9.1.1, 9.1.2, 9.1.3 (+57)

References

http://advisories.mageia.org/MGASA-2014-0524.html
http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-002.txt.asc
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10676
http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00013.html
http://lists.opensuse.org/opensuse-updates/2015-07/msg00038.html
http://marc.info/?l=bugtraq&m=142180687100892&w=2
http://marc.info/?l=bugtraq&m=144000632319155&w=2

Get alerted when CVE-2014-8500 or the next vulnerability affects your stack