Security Bulletin: Vulnerability in ISC BIND affects IBM Integrated Analytics System.

Summary

ISC BIND used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE(CVE-2021-25214 , CVE-2021-25215 ).

Vulnerability Details

CVEID:CVE-2021-25214
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by a broken inbound incremental zone update (IXFR). By sending a specially crafted IXFR, an attacker could exploit this vulnerability to trigger a failed assertion check and terminate the named process.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200961 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2021-25215
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an assertion failure while answering queries for DNAME records. By sending a query for DNAME records, an attacker could exploit this vulnerability to trigger a failed assertion check and terminate the named process.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200960 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying below security patch.

Please follow the steps given in release notes to upgrade system with security patches

Workarounds and Mitigations

None