PT-2016-7979 · Debian · Debian+1

Published 2025-06-26 · Updated 2025-06-27 · CVE-2014-7210

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: pdns versions prior to 3.3.1-1

Description: The issue arises from the pdns package in Debian, where the MySQL user is created with excessive privileges. Specifically, the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. This issue does not affect other backends.

Recommendations: For versions prior to 3.3.1-1, update to version 3.3.1-1 or later to resolve the issue. As a temporary workaround, consider restricting the database permissions for the pdns user to minimize the risk of exploitation.

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2014-7210

DLA-492-1

Affected Products

Debian

Pdns

References · 7

• https://salsa.debian.org/debian/pdns/-/commit/f0de6b3583039bb63344fbd5eb246939264d7b05 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7210 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-7210 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2016/05/msg00046.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7210 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-7210 · Vendor Advisory
• https://t.me/cvetracker/27172 · Telegram Post