Vulnerabilities > CVE-2016-5426 - Resource Management Errors vulnerability in Powerdns Authoritative
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Debian Local Security Checks NASL id DEBIAN_DLA-627.NASL description Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-5426 / CVE-2016-5427 Florian Heinz and Martin Kluge reported that the PowerDNS Authoritative Server accepts queries with a qname last seen 2020-03-17 modified 2016-09-19 plugin id 93567 published 2016-09-19 reporter This script is Copyright (C) 2016-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/93567 title Debian DLA-627-1 : pdns security update NASL family SuSE Local Security Checks NASL id OPENSUSE-2016-1103.NASL description This update for pdns fixes the following issues : - CVE-2016-5426, CVE-2016-5427: Fix case where crafted queries can cause unexpected backend load. (boo#998159) last seen 2020-06-05 modified 2016-09-26 plugin id 93699 published 2016-09-26 reporter This script is Copyright (C) 2016-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/93699 title openSUSE Security Update : pdns (openSUSE-2016-1103) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3664.NASL description Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-5426 / CVE-2016-5427 Florian Heinz and Martin Kluge reported that the PowerDNS Authoritative Server accepts queries with a qname last seen 2020-06-01 modified 2020-06-02 plugin id 93419 published 2016-09-12 reporter This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/93419 title Debian DSA-3664-1 : pdns - security update NASL family Fedora Local Security Checks NASL id FEDORA_2016-EFFFCC7AEC.NASL description - Update to 3.4.10 - CVE-2016-5426, CVE-2016-5427 Security advisory: https://docs.powerdns.com/md/security/powerdns-advisory-2016-01/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2016-10-06 plugin id 93890 published 2016-10-06 reporter This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/93890 title Fedora 23 : pdns (2016-efffcc7aec)
References
- http://www.debian.org/security/2016/dsa-3664
- http://www.debian.org/security/2016/dsa-3664
- http://www.openwall.com/lists/oss-security/2016/09/09/3
- http://www.openwall.com/lists/oss-security/2016/09/09/3
- http://www.securityfocus.com/bid/92917
- http://www.securityfocus.com/bid/92917
- http://www.securitytracker.com/id/1036761
- http://www.securitytracker.com/id/1036761
- https://doc.powerdns.com/md/security/powerdns-advisory-2016-01/
- https://doc.powerdns.com/md/security/powerdns-advisory-2016-01/
- https://github.com/PowerDNS/pdns/commit/881b5b03a590198d03008e4200dd00cc537712f3
- https://github.com/PowerDNS/pdns/commit/881b5b03a590198d03008e4200dd00cc537712f3