---
title: "BIND 8 Security Vulnerability Matrix"
slug: "aa-00959"
description: "This table summarizes the vulnerability to the bugs mentioned for all released versions of BIND 8 as of 2008. BIND 8 may be vulnerable to any or all of the BIND CVEs released since."
updated: 2022-03-03T17:54:55Z
published: 2022-03-03T17:54:55Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.isc.org/llms.txt
> Use this file to discover all available pages before exploring further.

# BIND 8 Security Vulnerability Matrix

This table summarizes the vulnerability to the bugs mentioned for all released versions of BIND 8 as of 2008. BIND 8 may be vulnerable to any or all of the BIND CVEs released since.

BIND 8 is in "End of Life" status, which means that we recommend that you not use it. As you can see from the table below, BIND 8 is vulnerable to modern attacks. Please use a newer version.

The numbers listed in the first row are the [CVE](http://cve.mitre.org/) (Common Vulnerabilities and Exposure) references and are hyperlinked to the appropriate pages on the CVE website, and are also listed in a separate table below, with a short description and links to the appropriate articles in this Knowledgebase.

| ver/CVE | [0](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833) | [1](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0835) | [2](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0837) | [3](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0848) | [4](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0849) | [5](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0851) | [6](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0887) | [7](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0888) | [8](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010) | [10](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0012) | [14](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [X](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [15](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [16](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [17](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | [18](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0033) | [27](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [28](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [29](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 8.4.7-P1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.4.7 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.4.6 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.4.5 |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0033) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.4.4 |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0033) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.4.3 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+;](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.4.2 |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.4.1 |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.4.0 |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.3.7 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.3.6 |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.3.5 |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.3.4 |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.3.3 |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.3.2 |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.3.1 |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.3.0 |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.2.7 |  |  |  |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.2.6 |  |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.2.5 |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.2.4 |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.2.3 |  |  |  |  |  |  |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.2.2 |  |  |  |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0849) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0851) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0887) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0888) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0012) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.2.1 | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0835) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0837) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0848) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0849) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0851) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0888) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0012) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |
| 8.2.0 | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0835) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0837) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0848) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0849) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0851) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0888) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0012) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) |  | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) |

#### Legend:

| # | CVE number | Short Description |
| --- | --- | --- |
| 0 | [1999-0833](https://kb.isc.org/docs/aa-00939) | Buffer overflow via NXT records. |
| 1 | [1999-0835](https://kb.isc.org/docs/aa-00942) | Denial of service via malformed SIG records. |
| 2 | 1999-0837 | Denial of service by improperly closing TCP sessions via so_linger. |
| 3 | [1999-0848](https://kb.isc.org/docs/aa-00943) | Denial of service named via consuming more than "fdmax" file descriptors. |
| 4 | [1999-0849](https://kb.isc.org/docs/aa-00940) | Denial of service via maxdname. |
| 5 | [1999-0851](https://kb.isc.org/docs/aa-00941) | Denial of service via naptr. |
| 6 | [2000-0887](https://kb.isc.org/docs/aa-00945) | Denial of service by compressed zone transfer (ZXFR) request. |
| 7 | [2000-0888](https://kb.isc.org/docs/aa-00944) | Denial of service via SRV record. |
| 8 | [2001-0010](https://kb.isc.org/docs/aa-00946) | tsig bug: Buffer overflow in TSIG code allows root privileges. |
| 10 | [2001-0012](https://kb.isc.org/docs/aa-00949) | Ability to access sensitive information such as environment variables. |
| 14 | [2002-0651](https://kb.isc.org/docs/aa-00951) | Buffer overflow in resolver code may cause a DoS and arbitrary code execution. |
| X | [2002-1219](https://kb.isc.org/docs/aa-00955) | Buffer overflow responses with SIG RR |
| 15 | [2002-1220](https://kb.isc.org/docs/aa-00953) | Denial of service via request for nonexistent subdomain using large OPT RR. |
| 16 | [2002-1221](https://kb.isc.org/docs/aa-00954) | Denial of service via SIG RR elements with invalid expiry times. |
| 17 | [2003-0914](https://kb.isc.org/docs/aa-00956) | Cache poisoning via negative responses with a large TTL value. |
| 18 | [2005-0033](https://kb.isc.org/docs/aa-00957) | Buffer overflow in recursion and glue code allows denial of service. |
| 27 | [2007-2930](https://kb.isc.org/docs/aa-00922) | cryptographically weak query ids (BIND 8) |
| 28 | [2008-0122](https://kb.isc.org/docs/aa-00923) | inet_network() off-by-one buffer overflow |
| 29 | [2008-1447](https://kb.isc.org/docs/aa-00924) | DNS cache poisoning issue |