PT-2016-6782 · Suse+1 · Opensuse Leap+2

Rgacogne · Published 2016-09-10 · Updated 2024-06-15 · CVE-2016-6172

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PowerDNS (aka pdns) Authoritative Server versions prior to 4.0.1 opensuse (affected versions not specified) opensuse leap (affected versions not specified) PowerDNS Authoritative Server (affected versions not specified)

Description The issue allows remote primary DNS servers to cause a denial of service, resulting in memory exhaustion and secondary DNS server crash. This can be achieved via a large AXFR or IXFR response.

Recommendations For PowerDNS (aka pdns) Authoritative Server versions prior to 4.0.1, update to version 4.0.1 or later to resolve the issue. For opensuse and opensuse leap, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting large AXFR or IXFR responses from remote primary DNS servers to minimize the risk of exploitation.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2016-6172

DLA-627-1

DSA-3664-1

MGASA-2016-0324

OPENSUSE-SU-2024:10136-1

OPENSUSE-SU-2024:10537-1

Affected Products

Powerdns Authoritative Server

Opensuse

Opensuse Leap

References · 35

• https://github.com/sischkg/xfer-limit/blob/master/README.md · Patch
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00085.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10136-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-6172 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6172 · Vendor Advisory
• https://debian.org/security/2016/dsa-3664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6172 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/WTT7ILQWU5FKY4GLFZV4V7B4VEUXETKL · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-6172 · Security Note
• https://ubuntu.com/security/CVE-2016-6172 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3664-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6172 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0324.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6172 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10537-1 · Vendor Advisory