Executive Summary
A single crafted TKEY query triggers a REQUIRE assertion failure in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3, forcing the named daemon to exit immediately. In OT environments where name resolution feeds HMI connectivity, historian queries, and remote engineering access, a crashed resolver translates directly into loss of visibility and loss of control paths.
Technical Exposure Breakdown
CVE-2015-5477 is a remotely triggerable denial of service carrying a CVSS score of 7.5. The defect sits in how named processes TKEY queries, which are used to negotiate transaction keys for secure dynamic updates. A single malformed query reaches a REQUIRE assertion, the assertion fails, and the daemon terminates. No authentication is required. No valid zone configuration is required. The attacker needs only the ability to send a UDP or TCP packet to port 53.
This is not a theoretical weakness. A public exploit exists, and the vulnerability is listed in the known exploited vulnerability catalog. The exploit is trivial to weaponize because the crash path is deterministic. One packet, one crash, repeated as fast as the attacker chooses.
The affected surface is broad. Per the grounding data, the vulnerable range covers ISC BIND 9.1.0 through 9.9.7 and 9.10.0 through 9.10.2. Beyond the reference implementation, the flaw is embedded in Juniper Junos across a large list of SRX and J-series platforms, including SRX300, SRX340, SRX550_HM, SRX650, SRX1400, SRX3400, SRX5600, and SRX5800, among many others. It also reaches HPE DNS, HPE VCX before 9.8.18, HP-UX, OpenVMS, NetApp Clustered Data ONTAP, Oracle Solaris, and the full set of enterprise Linux distributions. The Junos exposure matters most to OT because these firewalls and services gateways are commonly deployed as perimeter and segmentation devices at utility and pipeline sites. A DNS crash on a firewall platform is a different and worse problem than a crash on a dedicated resolver.
OT Impact and Compliance Risk
DNS is treated as plumbing until it fails. In modern OT and converged IT/OT deployments, name resolution underpins SCADA server lookups, OPC endpoint discovery, time synchronization sources, vendor remote access brokers, and historian replication. When named exits, these dependencies fail closed or fail unpredictably. Operators lose the ability to reach assets by name, and automated reconnection logic stalls.
The physical risk is availability. A resolver that can be crashed on demand is a remote availability lever an adversary can pull repeatedly during a coordinated event. For NERC CIP, this intersects with CIP-007 system security management and the broader availability expectations for BES Cyber Systems. For IEC 62443, it maps to the availability foundational requirement and zone and conduit integrity assumptions. For pipeline operators under TSA SD-02C and water utilities under AWIA 2018, an exploitable loss-of-availability condition in shared network services belongs in the required risk assessment and incident response planning.
Compensating Controls
Do not assume the patch has been applied simply because the CVE is a decade old. Embedded Junos, HPE, Solaris, and appliance firmware frequently run far behind the reference BIND version. Verify actual running versions before concluding you are clear.
- Block TKEY at the boundary. TKEY queries have no business arriving from untrusted segments. Filter DNS query type 249 (TKEY) at the firewall and at any IT/OT conduit. This is the fastest virtual patch available.
- Restrict port 53 reachability. OT resolvers should answer only internal subnets. If a field resolver is reachable from corporate or external ranges, close that path immediately.
- Deploy a detection signature. A Suricata rule concept: alert on DNS queries where the query type field equals 249 (TKEY) originating from non-authorized source ranges, inspecting both UDP and TCP port 53. This gives you alerting even where inline blocking is not yet possible.
- Add resolver redundancy and automatic restart. Because the attack forces daemon exit, a process supervisor that restarts named reduces outage windows, though it does not stop a determined attacker sending repeated packets.
Avoid active scanning of production OT resolvers and Junos platforms to confirm exposure. Malformed query probing can itself crash the daemon, and aggressive scanning can disrupt embedded components. Confirm versions through passive inventory and configuration review instead.
BreachSpider Intel
BreachSpider tracks KEV-listed exposures like CVE-2015-5477 across industrial and embedded platforms so OT teams can prioritize version verification without touching live control systems.