Resource exhaustion in PowerDNS - CVE-2016-7068
Published: September 11, 2018 / Updated: July 28, 2020
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
Affected software
Arch Linux
Fedora
Cisco Secure Access Control
pdns (Alpine package)
pdns-recursor (Alpine package)
pdns
pdns-recursor
How to mitigate CVE-2016-7068
pdns (Alpine package) - update to 4.0.3-r0
pdns-recursor (Alpine package) - update to 4.0.4-r0
pdns - addressed in versions 3.4.11-1.el7, 4.0.3-1.fc24, 4.0.3-1.fc25
pdns-recursor - addressed in versions 3.7.4-1.el6, 3.7.4-1.el7, 4.0.4-1.fc24, 4.0.4-1.fc25
External References
Related Security Bulletins
- Resource exhaustion in PowerDNS
- Resource exhaustion in pdns (Alpine package)
- Resource exhaustion in pdns-recursor (Alpine package)
- Arch Linux update for powerdns-recursor
- Arch Linux update for powerdns
- Fedora 24 update for pdns-recursor
- Fedora 25 update for pdns-recursor
- Fedora EPEL 7 update for pdns-recursor
- Fedora EPEL 6 update for pdns-recursor
- Fedora EPEL 7 update for pdns
- Fedora 25 update for pdns
- Fedora 24 update for pdns