Open-Xchange Pdns vulnerabilities

CVE-2016-2120 [MEDIUM] CVE-2016-2120: An issue has been found in PowerDNS Authoritative Server versions up to and including 3 An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record. The issue is due to an integer overflow when checking if the content of the record matches the expected size, allo

CVE-2008-3337 [MEDIUM] CVE-2008-3337: PowerDNS Authoritative Server before 2 PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make it easier for remote attackers to poison DNS caches of other products running on other servers, a different issue than CVE-2008-1447 and CVE-2008-3217.

CVE-2016-6172 [MEDIUM] CVE-2016-6172: PowerDNS (aka pdns) Authoritative Server before 4 PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

CVE-2016-7073 [MEDIUM] CWE-20 CVE-2016-7073: An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, all An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever, leading to a possible replay attack.

CVE-2016-7074 [MEDIUM] CWE-20 CVE-2016-7074: An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, all An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not cov

CVE-2012-0206 [MEDIUM] CVE-2012-0206: common_startup common_startup.cc in PowerDNS (aka pdns) Authoritative Server before 2.9.22.5 and 3.x before 3.0.1 allows remote attackers to cause a denial of service (packet loop) via a crafted UDP DNS response.

CVE-2005-0038 [MEDIUM] CVE-2005-0038: The DNS implementation of PowerDNS 2 The DNS implementation of PowerDNS 2.9.16 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop.

CVE-2020-17482 [MEDIUM] CVE-2020-17482: An issue has been found in PowerDNS Authoritative Server before 4 An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory.

CVE-2019-10203 [MEDIUM] CVE-2019-10203: PowerDNS Authoritative daemon , pdns versions 4 PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2^32-1 while trying to notify a slave leads to DoS.

CVE-2005-2301 [MEDIUM] CVE-2005-2301: PowerDNS before 2 PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service (failure to answer ldap questions) and possibly conduct an LDAP injection attack.

CVE-2019-10163 [MEDIUM] CVE-2019-10163: A Vulnerability has been found in PowerDNS Authoritative Server before versions 4 A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.

CVE-2005-0428 [MEDIUM] CVE-2005-0428: The DNSPacket::expand method in dnspacket The DNSPacket::expand method in dnspacket.cc in PowerDNS before 2.9.17 allows remote attackers to cause a denial of service by sending a random stream of bytes.

CVE-2008-5277 [MEDIUM] CVE-2008-5277: PowerDNS before 2 PowerDNS before 2.9.21.2 allows remote attackers to cause a denial of service (daemon crash) via a CH HINFO query.

CVE-2005-2302 [LOW] CVE-2005-2302: PowerDNS before 2 PowerDNS before 2.9.18, when allowing recursion to a restricted range of IP addresses, does not properly handle questions from clients that are denied recursion, which could cause a "blank out" of answers to those clients that are allowed to use recursion.