ISC BIND 9 Remote Denial of Service (DoS) via TKEY Query (CVE-2015-5477)

The primary remediation is to upgrade to a patched version of BIND.

1. Package Update

Update BIND using your operating system's package manager:

# Ubuntu/Debian
sudo apt-get update && sudo apt-get install --only-upgrade bind9

# RHEL/CentOS
sudo yum update bind

2. Source Installation

If BIND was installed from source, download the latest patched version from the ISC website and recompile.

3. Temporary Mitigation

Until patching is possible, restrict DNS access (UDP/TCP port 53) to trusted networks only using firewalls or ACLs to minimize the attack surface.

The vulnerability is caused by a 'Reachable Assertion' error (CWE-617) within the TKEY record handling logic of ISC BIND. By sending a specifically malformed TKEY query, an unauthenticated remote attacker can trigger a REQUIRE assertion failure, causing the 'named' process to exit abruptly. This results in a complete Denial of Service (DoS) for DNS resolution. Given its inclusion in the CISA KEV catalog and a high EPSS score (0.94), this vulnerability is a high-priority threat that has been actively exploited in the wild.