CVE-2016-7068 — Improper Input Validation in Authoritative

CWE-20 — Improper Input ValidationCWE-400 — Uncontrolled Resource Consumption6 documents6 sources
Severity
7.5HIGHNVD
CNA5.3
EPSS
0.1%
top 75.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Open-xchange PdnsPowerdns AuthoritativePowerdns Recursor+1 more
Timeline
PublishedSep 11
Latest updateMay 13

Description

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted q…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDpowerdns/recursor4.0.0 — 4.0.4+1
▶NVDpowerdns/authoritative4.0.0 — 4.0.2+1
▶Debianopen-xchange/pdns< 4.0.2-1+3
▶CVEListV5open-xchange/pdns4 versions+3

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
GHSA
GHSA-g832-5583-wc79: An issue has been found in PowerDNS before 3↗2022-05-13
▶
OSV
CVE-2016-7068: An issue has been found in PowerDNS before 3↗2018-09-11
▶
CVEList
CVE-2016-7068: An issue has been found in PowerDNS before 3↗2018-09-11
▶

📋Vendor Advisories

1
Debian
CVE-2016-7068: pdns - An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recurs...↗2016
▶

💬Community

1
Bugzilla
CVE-2016-7068 pdns: Crafted queries can cause abnormal CPU usage↗2018-09-10
▶
CVE-2016-7068 — Improper Input Validation | cvebase