CVE-2013-4854

High PUBLISHED

The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND...

ISC · BIND

Not yet in CISA KEV

Exploited in the wild

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

7.8 High

At a Glance

The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.

CVE Published: Jul 26, 2013
Exploitation Reported: Jul 26, 2013
CVSS: 7.8 High
EPSS: —

Remote Low complexity Unauthenticated

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

FEDORA-2013-13863 lists.fedoraproject.org · Vendor Advisory http://lists.fedoraproject.org/pipermail/package-announce/2013-August...
HPSBUX02926 h20564.www2.hp.com · Vendor Advisory https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docI...
APPLE-SA-2014-10-16-3 archives.neohapsis.com · Vendor Advisory http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
MDVSA-2013:202 mandriva.com · Vendor Advisory http://www.mandriva.com/security/advisories?name=MDVSA-2013:202
FreeBSD-SA-13:07 freebsd.org · Vendor Advisory http://www.freebsd.org/security/advisories/FreeBSD-SA-13:07.bind.asc

Show 24 more references

FEDORA-2013-13831 lists.fedoraproject.org · Vendor Advisory http://lists.fedoraproject.org/pipermail/package-announce/2013-August...
openSUSE-SU-2013:1354 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00018...
RHSA-2013:1114 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2013-1114.html
SUSE-SU-2013:1310 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00004...
USN-1910-1 ubuntu.com · Vendor Advisory http://www.ubuntu.com/usn/USN-1910-1
DSA-2728 debian.org · Vendor Advisory http://www.debian.org/security/2013/dsa-2728
RHSA-2013:1115 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2013-1115.html
54134 secunia.com · Third-Party Advisory http://secunia.com/advisories/54134
54185 secunia.com · Third-Party Advisory http://secunia.com/advisories/54185
54207 secunia.com · Third-Party Advisory http://secunia.com/advisories/54207
54323 secunia.com · Third-Party Advisory http://secunia.com/advisories/54323
54211 secunia.com · Third-Party Advisory http://secunia.com/advisories/54211
54432 secunia.com · Third-Party Advisory http://secunia.com/advisories/54432
oval:org.mitre.oval:def:19561 oval.cisecurity.org · VDB Entry https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.m...
isc-bind-cve20134854-dos(86004) exchange.xforce.ibmcloud.com · VDB Entry https://exchange.xforce.ibmcloud.com/vulnerabilities/86004
61479 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/61479
1028838 securitytracker.com · VDB Entry http://www.securitytracker.com/id/1028838
20130806 [slackware-security] bind (SSA:2013-218-01) archives.neohapsis.com · Mailing List http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.html
kb.isc.org/article/AA-01015 kb.isc.org · CVE Record https://kb.isc.org/article/AA-01015
linux.oracle.com/errata/ELSA-2014-1244 linux.oracle.com · CVE Record http://linux.oracle.com/errata/ELSA-2014-1244
kb.isc.org/article/AA-01016 kb.isc.org · CVE Record https://kb.isc.org/article/AA-01016
kc.mcafee.com/corporate/index kc.mcafee.com · CVE Record https://kc.mcafee.com/corporate/index?page=content&id=SB10052
support.apple.com/kb/HT6536 support.apple.com · CVE Record https://support.apple.com/kb/HT6536
zerodayinitiative.com/advisories/ZDI-13-210 zerodayinitiative.com · CVE Record http://www.zerodayinitiative.com/advisories/ZDI-13-210/

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CVE First	2013-07-26 23:00 UTC

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2013-4854

{
  "cve_id": "CVE-2013-4854",
  "title": "The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8...",
  "affected_vendor": "ISC",
  "affected_product": "BIND",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 7.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.