Resource exhaustion in Knot DNS - CVE-2016-6171
Published: February 9, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU39670
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-6171
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to a crash the entire system.
Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS, (2) AXFR, or (3) IXFR.
Affected software
Knot DNS
Fedora
knot
Fedora
knot
How to mitigate CVE-2016-6171
Install update from vendor's website.
Knot DNS - update to 2.3.0
knot - addressed in versions 1.6.8-1.el6, 1.6.8-1.el7, 2.3.0-1.fc23, 2.3.0-1.fc24, 2.3.0-1.fc25, 2.3.0-2.fc23, 2.3.0-2.fc24, 2.3.0-2.fc25
knot - addressed in versions 1.6.8-1.el6, 1.6.8-1.el7, 2.3.0-1.fc23, 2.3.0-1.fc24, 2.3.0-1.fc25, 2.3.0-2.fc23, 2.3.0-2.fc24, 2.3.0-2.fc25
External References
- http://www.openwall.com/lists/oss-security/2016/07/06/3
- http://www.openwall.com/lists/oss-security/2016/07/06/4
- http://www.securityfocus.com/bid/91678
- https://github.com/sischkg/xfer-limit/blob/master/README.md
- https://gitlab.labs.nic.cz/labs/knot/blob/c546a70563ef4c7badb7cb5bdf6d1ba8e7adae82/NEWS
- https://gitlab.labs.nic.cz/labs/knot/issues/464
- https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015058.html