Skip to content
Fencer Vulns
high 8.1

CVE-2021-25216 in the critical feed json

A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

published 2021-04-29 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-12127

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
83.0%
EPSS 83.0% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known

Summary

In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. For servers that meet these conditions, the ISC SPNEGO implementation is vulnerable to various attacks, depending on the CPU architecture for which BIND was built: For named binaries compiled for 64-bit platforms, this flaw can be used to trigger a buffer over-read, leading to a server crash. For named binaries compiled for 32-bit platforms, this flaw can be used to trigger a server crash due to a buffer overflow and possibly also to achieve remote code execution. We have determined that standard SPNEGO implementations are available in the MIT and Heimdal Kerberos libraries, which support a broad range of operating systems, rendering the ISC implementation unnecessary and obsolete. Therefore, to reduce the attack surface for BIND users, we will be removing the ISC SPNEGO implementation in the April releases of BIND 9.11 and 9.16 (it had already been dropped from BIND 9.17). We would not normally remove something from a stable ESV (Extended Support Version) of BIND, but since system libraries can replace the ISC SPNEGO implementation, we have made an exception in this case for reasons of stability and security.

Patch / fix

  • isc bind 9.11.31, 9.16.15, 9.17.12
  • siemens sinec_infrastructure_network_services 1.0.1.1
  • bind9 Debian 14, Debian 13, Debian 12 1:9.16.15-1

debian advisories DEBIAN-CVE-2021-25216

  • bind9 Ubuntu 16.04 LTS 1:9.10.3.dfsg.P4-8ubuntu1.19
  • bind9 Ubuntu 18.04 LTS 1:9.11.3+dfsg-1ubuntu1.15
  • bind9 Ubuntu 20.04 LTS 1:9.16.1-0ubuntu2.8
  • bind9 Ubuntu Pro 14.04 LTS 1:9.9.5.dfsg-3ubuntu0.19+esm13

ubuntu advisories UBUNTU-CVE-2021-25216

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 9.9.6P1-0.51.26.1
  • bind SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 9.9.9P1-63.25.1

suse advisories SUSE-SU-2021:14714-1SUSE-SU-2021:1469-1

  • bind openSUSE Tumbleweed 9.16.20-1.4

opensuse advisories openSUSE-SU-2024:10650-1

  • bind Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 9.16.15-r0

alpine advisories ALPINE-CVE-2021-25216

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind Arch Linux 9.16.15-1

arch linux advisories AVG-1890

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-25216 updated cvss 8.1

bind: Vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

  • Red Hat Enterprise Linux 5 bind, bind97 Red Hat Enterprise Linux 6 bind, bind-sdb, bind-libs, bind-utils, bind-chroot Red Hat Enterprise Linux 7 bind, bind-sdb, bind-libs, bind-utils, bind-chroot, bind-pkcs11, +6 more Red Hat Enterprise Linux 8 bind, bind-sdb, bind-libs, bind-utils, bind-chroot, bind-pkcs11, +7 more Red Hat Enterprise Linux 9 bind, bind-libs, bind-utils, bind-chroot, bind-license, python3-bind, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

82.99% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • ISC BIND9

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.