CVE-2015-4620

What it actually does

Crafted zone data triggers a REQUIRE assertion failure in name.c during DNSSEC validation in recursive resolver mode, causing the named daemon to exit and terminate all query processing.

Why it matters to the business

Recursive DNS services experience sudden outages, interrupting name resolution for dependent applications, internal systems, and external connectivity until the service is restarted.

How an attack unfolds

An attacker prepares malicious zone data containing invalid DNSSEC records, serves or references that zone, then issues a query for a name within it to a target recursive resolver; the server performs validation, hits the assertion, and crashes.

How to fix it

Upgrade ISC BIND to version 9.9.7-P1, 9.10.2-P2, or later releases that contain the corrected name.c handling; restart the service after upgrade and re-validate DNSSEC configuration.

How to confirm the fix worked

Execute 'named -v' to confirm the running version meets or exceeds the fixed releases; review named.conf for dnssec-validation settings; perform controlled queries against test zones to verify absence of crashes.

Typical attack path

1. Locate recursive BIND resolvers with DNSSEC validation enabled
2. Construct or obtain crafted zone data containing malformed DNSSEC elements
3. Make the zone reachable to the target resolver
4. Issue a DNS query for a name inside the crafted zone
5. Trigger assertion failure and observe daemon termination

How to detect it

Search syslog and named logs for fatal assertion failures referencing name.c or REQUIRE statements immediately preceding named process termination; correlate with unusual inbound queries for recently observed zones.

• REQUIRE assertion failure
• named: general: error: fatal error:
• exiting (due to assertion failure)
• name.c

What your security team should do

• Prioritize upgrade of all recursive resolvers to fixed BIND versions
• Audit DNSSEC-enabled recursive configurations and disable validation only where absolutely necessary
• Add monitoring for named process restarts and assertion-related log entries