SB2016110135 - Fedora EPEL 6 update for pdns

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016110135

SB2016110135 - Fedora EPEL 6 update for pdns

Published: November 1, 2016 Updated: April 24, 2025

Security Bulletin ID SB2016110135
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Denial of service (CVE-ID: CVE-2016-5426)

The vulnerability allows a remote user to cause excessive resources spending on the target system.
The weakness exists due to sending of specially crafted DNS queries with length of qname value more than 255 bytes that may lead to denial of service.
The vulnerability may result in consuming of excessive resources and denial of service on the vulnerable system.


2) Denial of service (CVE-ID: CVE-2016-5427)

The vulnerability allows a remote user to cause excessive resources spending on the target system.
The weakness exists due to sending of specially crafted DNS queries with label values containing a dot character ('.') that may lead to denial of service.
The vulnerability may result in consuming of excessive resources and denial of service on the vulnerable system.


3) Improper input validation (CVE-ID: CVE-2016-6172)

The vulnerability allows a remote attacker to cause the target service to crash.

The vulnerability exists due to resource error in PowerDNS. A remote unauthenticated attacker can cause the target service to crash by sending a specially crafted AXFR response or IXFR response.

Successful exploitation of this vulnerability may result in denial of service via network

Remediation

Install update from vendor's website.

References