--- title: "BIND 8 Security Vulnerability Matrix" slug: "aa-00959" description: "This table summarizes the vulnerability to the bugs mentioned for all released versions of BIND 8 as of 2008. BIND 8 may be vulnerable to any or all of the BIND CVEs released since." updated: 2022-03-03T17:54:55Z published: 2022-03-03T17:54:55Z canonical: "kb.isc.org/aa-00959" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://kb.isc.org/llms.txt > Use this file to discover all available pages before exploring further. # BIND 8 Security Vulnerability Matrix This table summarizes the vulnerability to the bugs mentioned for all released versions of BIND 8 as of 2008. BIND 8 may be vulnerable to any or all of the BIND CVEs released since. BIND 8 is in "End of Life" status, which means that we recommend that you not use it. As you can see from the table below, BIND 8 is vulnerable to modern attacks. Please use a newer version. The numbers listed in the first row are the [CVE](http://cve.mitre.org/) (Common Vulnerabilities and Exposure) references and are hyperlinked to the appropriate pages on the CVE website, and are also listed in a separate table below, with a short description and links to the appropriate articles in this Knowledgebase. | ver/CVE | [0](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833) | [1](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0835) | [2](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0837) | [3](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0848) | [4](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0849) | [5](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0851) | [6](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0887) | [7](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0888) | [8](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010) | [10](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0012) | [14](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [X](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [15](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [16](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [17](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | [18](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0033) | [27](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [28](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [29](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | 8.4.7-P1 | | | | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.4.7 | | | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.4.6 | | | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.4.5 | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0033) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.4.4 | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0033) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.4.3 | | | | | | | | | | | | | | | | | [+;](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.4.2 | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.4.1 | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.4.0 | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.3.7 | | | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.3.6 | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.3.5 | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.3.4 | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.3.3 | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.3.2 | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.3.1 | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.3.0 | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.2.7 | | | | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.2.6 | | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.2.5 | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.2.4 | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.2.3 | | | | | | | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.2.2 | | | | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0849) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0851) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0887) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0888) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0012) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.2.1 | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0835) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0837) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0848) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0849) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0851) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0888) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0012) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | | 8.2.0 | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0833) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0835) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0837) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0848) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0849) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0851) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0888) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0010) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0012) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0651) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1219) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1220) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1221) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0914) | | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2930) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0122) | [+](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447) | #### Legend: | # | CVE number | Short Description | | --- | --- | --- | | 0 | [1999-0833](https://kb.isc.org/docs/aa-00939) | Buffer overflow via NXT records. | | 1 | [1999-0835](https://kb.isc.org/docs/aa-00942) | Denial of service via malformed SIG records. | | 2 | 1999-0837 | Denial of service by improperly closing TCP sessions via so_linger. | | 3 | [1999-0848](https://kb.isc.org/docs/aa-00943) | Denial of service named via consuming more than "fdmax" file descriptors. | | 4 | [1999-0849](https://kb.isc.org/docs/aa-00940) | Denial of service via maxdname. | | 5 | [1999-0851](https://kb.isc.org/docs/aa-00941) | Denial of service via naptr. | | 6 | [2000-0887](https://kb.isc.org/docs/aa-00945) | Denial of service by compressed zone transfer (ZXFR) request. | | 7 | [2000-0888](https://kb.isc.org/docs/aa-00944) | Denial of service via SRV record. | | 8 | [2001-0010](https://kb.isc.org/docs/aa-00946) | tsig bug: Buffer overflow in TSIG code allows root privileges. | | 10 | [2001-0012](https://kb.isc.org/docs/aa-00949) | Ability to access sensitive information such as environment variables. | | 14 | [2002-0651](https://kb.isc.org/docs/aa-00951) | Buffer overflow in resolver code may cause a DoS and arbitrary code execution. | | X | [2002-1219](https://kb.isc.org/docs/aa-00955) | Buffer overflow responses with SIG RR | | 15 | [2002-1220](https://kb.isc.org/docs/aa-00953) | Denial of service via request for nonexistent subdomain using large OPT RR. | | 16 | [2002-1221](https://kb.isc.org/docs/aa-00954) | Denial of service via SIG RR elements with invalid expiry times. | | 17 | [2003-0914](https://kb.isc.org/docs/aa-00956) | Cache poisoning via negative responses with a large TTL value. | | 18 | [2005-0033](https://kb.isc.org/docs/aa-00957) | Buffer overflow in recursion and glue code allows denial of service. | | 27 | [2007-2930](https://kb.isc.org/docs/aa-00922) | cryptographically weak query ids (BIND 8) | | 28 | [2008-0122](https://kb.isc.org/docs/aa-00923) | inet_network() off-by-one buffer overflow | | 29 | [2008-1447](https://kb.isc.org/docs/aa-00924) | DNS cache poisoning issue |