CVE-2016-7068 log
Source |
|
Severity | Medium |
Remote | Yes |
Type | Denial of service |
Description | An issue has been found in PowerDNS allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour. |
Group | Package | Affected | Fixed | Severity | Status | Ticket |
---|---|---|---|---|---|---|
AVG-148 | powerdns-recursor | 4.0.3-7 | 4.0.4-1 | Medium | Fixed | |
AVG-147 | powerdns | 4.0.1-7 | 4.0.2-1 | Medium | Fixed |
Date | Advisory | Group | Package | Severity | Type |
---|---|---|---|---|---|
19 Jan 2017 | ASA-201701-30 | AVG-148 | powerdns-recursor | Medium | multiple issues |
19 Jan 2017 | ASA-201701-29 | AVG-147 | powerdns | Medium | multiple issues |
References |
---|
http://seclists.org/oss-sec/2017/q1/97 https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ |
Notes |
---|
PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. PowerDNS Recursor up to and including 3.7.3 and 4.0.3 are affected. |