Vulnerability record · CVE-2015-8000 · published 16 December 2015
CVE-2015-8000: ISC BIND named malformed class attribute denial of service
Oracle · Linux
ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 fail to properly validate a malformed class attribute in db.c, triggering a REQUIRE assertion failure that exits the named daemon. Because BIND is widely used as authoritative and recursive DNS, a successful hit takes DNS resolution offline for anything relying on that server.
Description
db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityUnauthenticated remote crash of a core DNS service with very high EPSS, though impact is limited to availability and no KEV listing exists.
What it is
ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 fail to properly validate a malformed class attribute in db.c, triggering a REQUIRE assertion failure that exits the named daemon. Because BIND is widely used as authoritative and recursive DNS, a successful hit takes DNS resolution offline for anything relying on that server.
Impact
A remote attacker can crash the named process, causing a denial of service for DNS resolution and any dependent services. There is no confidentiality or integrity impact; the effect is availability loss only.
Attack surface
Reachable over the network via DNS traffic to a vulnerable named instance; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The malformed class attribute is delivered in a DNS message to the server.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is 0.5469 (99th percentile), indicating a high modeled likelihood of exploitation activity. Reference tags are mostly vendor advisories with no explicit exploit tag, so confirmed in-the-wild exploitation is not established by this record.
What to do
- Upgrade BIND to 9.9.8-P2, 9.10.3-P2 or later, or apply the vendor patch for your distribution (Red Hat, Debian, openSUSE, Slackware, Oracle).
- If immediate patching is not possible, restrict DNS query access to trusted networks and disable recursion on externally exposed resolvers.
- Monitor vendor advisories for Oracle Solaris, VM Server and Linux packages and apply the corresponding updates.
- Verify the running named version after patching and restart the service to ensure the fix is active.
Detection
- Alert on named process exits or restarts, especially REQUIRE assertion failures in logs.
- Monitor DNS query logs for malformed or unexpected class attribute values.
- Track availability gaps in DNS resolution from monitoring probes to catch daemon crashes.
- Correlate named crash events with recent query sources to identify a potential attack origin.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-8000 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-8000), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
