PT-2018-4978 · Powerdns+1 · Powerdns Authoritative Server+1

Mongo · Published 2017-01-13 · Updated 2024-06-15 · CVE-2016-7072

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PowerDNS Authoritative Server versions prior to 3.4.11 PowerDNS Authoritative Server versions prior to 4.0.2

Description A remote, unauthenticated attacker can cause a denial of service by opening a large number of TCP connections to the web server, potentially triggering an exception and terminating the PowerDNS process if the web server runs out of file descriptors.

Recommendations For PowerDNS Authoritative Server versions prior to 3.4.11, update to version 3.4.11 or later. For PowerDNS Authoritative Server versions prior to 4.0.2, update to version 4.0.2 or later.

Fix

DoS

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

ALT-PU-2017-1425

CVE-2016-7072

DLA-798-1

DSA-3764-1

MGASA-2017-0033

OPENSUSE-SU-2024:11156-1

Affected Products

Alt Linux

Powerdns Authoritative Server

References · 47

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5426 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-1425 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/pdns · Vendor Advisory
• https://doc.powerdns.com/md/security/powerdns-advisory-2016-03 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0033 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-7072 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7072 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7072 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11156-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3764-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7073 · Security Note
• https://ubuntu.com/security/CVE-2016-7072 · Vendor Advisory
• https://debian.org/security/2017/dsa-3764 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2120 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5470 · Security Note