CVE-2015-8000

What it actually does

A malformed class attribute in a DNS message triggers an assertion failure in db.c within the named process, causing an immediate daemon exit and denial of service.

Why it matters to the business

Unexpected DNS server outages interrupt name resolution for dependent applications and services, leading to degraded availability until the daemon is restarted.

How an attack unfolds

An unauthenticated remote attacker crafts a DNS query containing an invalid class value and sends it to an exposed BIND named instance; the server processes the packet, hits the REQUIRE assertion, and terminates.

How to fix it

Upgrade ISC BIND to version 9.9.8-P2 or newer for the 9.9 branch and 9.10.3-P2 or newer for the 9.10 branch; restart the named service after installation and verify the running version.

How to confirm the fix worked

Confirm the installed BIND version meets or exceeds the fixed releases; attempt to reproduce the crash with a test packet containing an invalid class attribute in a controlled environment and verify the daemon remains stable.

Typical attack path

1. Identify reachable BIND 9.x named instances
2. Craft a DNS packet with a malformed class attribute
3. Transmit the packet over UDP or TCP to the DNS listener
4. Observe process termination and service unavailability

How to detect it

Inspect named process logs and system crash reports for assertion failure messages referencing db.c or class attribute handling; correlate sudden named daemon restarts with inbound DNS traffic spikes.

• REQUIRE assertion failure
• db.c
• malformed class attribute

What your security team should do

• Apply the version-specific patches immediately on all affected systems
• Restrict DNS listener exposure to trusted networks where feasible
• Enable process monitoring and automatic restart for named
• Review and update change-management processes for legacy DNS deployments