CVE-2016-7073 — Improper Input Validation in Authoritative

CWE-20 — Improper Input Validation6 documents6 sources
Severity
5.9MEDIUMNVD
CNA5.3
EPSS
0.0%
top 99.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Open-xchange PdnsPowerdns AuthoritativePowerdns Recursor+1 more
Timeline
PublishedSep 11
Latest updateMay 13

Description

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever, leading to a possible replay attack.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages4 packages

▶NVDpowerdns/recursor4.0.0 — 4.0.4+1
▶NVDpowerdns/authoritative4.0.0 — 4.0.2+1
▶Debianopen-xchange/pdns< 4.0.2-1+3
▶CVEListV5open-xchange/pdns3.4.11, 4.0.2, 4.0.4+2

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
GHSA
GHSA-pm63-cw3m-c2g8: An issue has been found in PowerDNS before 3↗2022-05-13
▶
CVEList
CVE-2016-7073: An issue has been found in PowerDNS before 3↗2018-09-11
▶
OSV
CVE-2016-7073: An issue has been found in PowerDNS before 3↗2018-09-11
▶

📋Vendor Advisories

1
Debian
CVE-2016-7073: pdns - An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recurs...↗2016
▶

💬Community

1
Bugzilla
CVE-2016-7073 pdns: Insufficient validation of TSIG signatures↗2018-09-10
▶
CVE-2016-7073 — Improper Input Validation | cvebase