CVE-2016-7068
Description
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
How to fix
- powerdns recursor3.7.4, 4.0.4 or later
- powerdns authoritative3.4.11, 4.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| powerdns recursor | v < 3.7.4, 4.0.0 ≤ v < 4.0.4 | 3.7.4, 4.0.4 |
| powerdns authoritative | v < 3.4.11, 4.0.0 ≤ v < 4.0.2 | 3.4.11, 4.0.2 |
| debian debian_linux | 8.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.