BIND TKEY crash exploited in the wild (CVE-2015-5477) [PoC]
CVE-2015-5477
CVE-2015-5477: BIND 9.x TKEY queries trigger a REQUIRE assertion failure and daemon exit (CVSS 7.8). Upgrade to 9.9.7-P2 or 9.10.2-P3 immediately.
Actively exploited in the wild - CVE-2015-5477 is a high-severity denial-of-service flaw in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 that lets unauthenticated remote attackers crash the named daemon with a single crafted TKEY query. Patched releases are available; DNS operators running older versions must upgrade now.
Overview
BIND is the most widely deployed DNS server software on the internet, and this flaw sits in the code that handles TKEY queries - a DNS record type used for key negotiation. When a crafted TKEY query reaches an affected version, BIND fails an internal REQUIRE assertion and terminates the named process. Because the query is sent over the network with no authentication, anyone who can reach port 53 can trigger the crash.
The published CVSS score is 7.8. The attack vector is network, complexity is low, and no privileges or user interaction are required. That combination makes exploitation trivial: a single UDP packet is enough.
Impact
A successful attack takes the DNS resolver or authoritative server offline. Any service depending on that server - web traffic, email delivery, VPN authentication, internal name resolution - fails or slows to a crawl until the daemon restarts or an operator intervenes. Repeated queries keep the daemon down, turning a momentary crash into a sustained outage. This vulnerability is confirmed as actively exploited, so exposure should be treated as ongoing rather than theoretical.
Remediation
- Upgrade to BIND 9.9.7-P2 or 9.10.2-P3 (or any later release). Older 9.8.x and 9.9.x branches should move to a supported version, since BIND 9.8 reached end of life well before this flaw was patched.
- Restart the named daemon after upgrading so the fixed binary is loaded.
- If you cannot patch immediately, restrict port 53 access to trusted networks and disable recursion on servers that do not need it. Neither measure fully mitigates the flaw, since TKEY queries can arrive from any reachable source.
- Monitor DNS logs for unusual TKEY query volume, which may indicate scanning or active exploitation.
For organizations tracking related incidents, data breach reports are available at breach reports and ongoing coverage at security news.
Security Insight
CVE-2015-5477 is a textbook example of an assertion failure shipping in a core internet service, and its long tail shows why: years after the patch, vulnerable BIND versions still answered queries across the internet, which is why it earned a place in CISA’s Known Exploited Vulnerabilities catalog. The flaw also highlights how expensive reachability is for DNS - because resolvers must answer unauthenticated queries by design, any crash bug in the query path becomes a remote off switch. Operators who treat DNS as infrastructure that “just works” rather than software that needs version tracking are the ones this class of bug keeps finding.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Metasploit Modules
Weaponized exploit code — authorized use only
The Metasploit Framework modules below are production-ready exploit code maintained by Rapid7. Unlike random GitHub PoCs, these are vetted by Metasploit maintainers and integrated into a point-and-click exploitation framework used by red teams worldwide. The presence of an MSF module means this CVE is trivially exploitable at scale — patch immediately.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| Module | Source |
|---|---|
auxiliary/dos/dns/bind_tkey | View source |
1 Metasploit module indexed for this CVE. Source: rapid7/metasploit-framework.
Exploit-DB Entries
Curated public exploit code — authorized use only
The entries below are human-reviewed exploit code hosted on Exploit-DB by Offensive Security. Lower volume than random GitHub PoCs but higher signal: every entry is curated, many are tagged "verified" by the maintainers. Treat as production-ready exploit code.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| EDB-ID | Title | Status |
|---|---|---|
| EDB-37721 | ISC BIND 9 - TKEY (PoC) | verified |
| EDB-37723 | ISC BIND 9 - TKEY Remote Denial of Service (PoC) | unverified |
2 Exploit-DB entries indexed for this CVE. Source: Exploit-DB.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| robertdavidgraham/cve-2015-5477 PoC exploit for CVE-2015-5477 BIND9 TKEY assertion failure | ★ 64 |
| elceef/tkeypoc PoC exploit code for CVE-2015-5477 BIND9 TKEY remote DoS vulnerability | ★ 14 |
| hmlio/vaas-cve-2015-5477 Vulnerability as a service: showcasing CVS-2015-5447, a DDoS condition in the bind9 software | ★ 1 |
| knqyf263/cve-2015-5477 PoC for BIND9 TKEY assert DoS (CVE-2015-5477) | ★ 1 |
| ilanyu/cve-2015-5477 PoC exploit for CVE-2015-5477 in php | ★ 1 |
Showing 5 of 6 known references. Source: nomi-sec/PoC-in-GitHub.
Related Advisories
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthe...
Microsoft Defender Denial of Service Vulnerability...
An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSS...
Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-produ...