CVEs-PoC/2021/CVE-2021-25214.md

### [CVE-2021-25214](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25214)
![](https://img.shields.io/static/v1?label=Product&message=BIND9&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Development%20Branch%209.17%209.17.0%20through%20versiosn%20before%209.17.12%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=Open%20Source%20Branch%209.8%209.8.5%20through%209.8.8%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=Open%20Source%20Branches%209.12%20through%209.16%209.12.0%20through%20versions%20before%209.16.14%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=Open%20Source%20Branches%209.9%20through%209.11%209.9.3%20through%20versions%20before%209.11.30%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=Supported%20Preview%20Branch%209.16-S%209.16.8-S1%20through%20versions%20before%209.16.14-S1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=Supported%20Preview%20Branches%209.9-S%20through%209.11-S%209.9.3-S1%20through%20versions%20before%209.11.30-S1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Incremental%20zone%20transfers%20(IXFR)%20provide%20a%20way%20of%20transferring%20changed%20portion(s)%20of%20a%20zone%20between%20servers.%20An%20IXFR%20stream%20containing%20SOA%20records%20with%20an%20owner%20name%20other%20than%20the%20transferred%20zone's%20apex%20may%20cause%20the%20receiving%20named%20server%20to%20inadvertently%20remove%20the%20SOA%20record%20for%20the%20zone%20in%20question%20from%20the%20zone%20database.%20This%20leads%20to%20an%20assertion%20failure%20when%20the%20next%20SOA%20refresh%20query%20for%20that%20zone%20is%20made.%20%20Affects%20BIND%209.8.5%20-%3E%209.8.8%2C%209.9.3%20-%3E%209.11.29%2C%209.12.0%20-%3E%209.16.13%2C%20and%20versions%20BIND%209.9.3-S1%20-%3E%209.11.29-S1%20and%209.16.8-S1%20-%3E%209.16.13-S1%20of%20BIND%209%20Supported%20Preview%20Edition%2C%20as%20well%20as%20release%20versions%209.17.0%20-%3E%209.17.11%20of%20the%20BIND%209.17%20development%20branch.&color=brightgreen)

### Description

In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/Maribel0370/Nebula-io
- https://github.com/fokypoky/places-list
- https://github.com/krlabs/dnsbind-vulnerabilities
- https://github.com/psmedley/bind-os2