USN-8929-1: Bind vulnerabilities
Ubuntu patched Bind flaws that could cause denial of service or DNS cache poisoning.
Ubuntu security notice USN-8929-1 covers Bind flaws on older Ubuntu LTS releases. CVE-2025-8677, found by Zuyao Xu and Xiang Li, can let a remote attacker exhaust resources with malformed DNSKEY records on Ubuntu 14.04, 16.04, and 18.04 LTS. CVE-2025-40778, found by Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan, may allow cache poisoning and affects only Ubuntu 18.04 LTS. A third insecure-delegation issue is mentioned but its CVE is not included in the provided text. No in-the-wild exploitation is stated.
- CVE-2025-8677: malformed DNSKEY records may cause a Bind denial of service on Ubuntu 14.04, 16.04, and 18.04.
- CVE-2025-40778: accepting certain answer records could enable cache poisoning, only on Ubuntu 18.04 LTS.
- The notice does not report active exploitation.
Vulnerabilities mentionedAll →
- CVE-2025-407788.6<1%Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cachepublished
- CVE-2025-86777.511%Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677) Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778) Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could…
This source does not provide full text. Read it at ubuntu.com.