CVE-2015-1868

The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156725.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156743.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156655.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156667.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156648.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156680.html	Third Party Advisory
http://www.securitytracker.com/id/1032220	Third Party Advisory
http://www.securityfocus.com/bid/74306	Third Party Advisory
http://www.debian.org/security/2015/dsa-3307
http://www.debian.org/security/2015/dsa-3306

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:powerdns:authoritative:3.2:::::::*
	cpe:2.3:a:powerdns:authoritative:3.3:::::::*
	cpe:2.3:a:powerdns:authoritative:3.3.1:::::::*
	cpe:2.3:a:powerdns:authoritative:3.3.2:::::::*
	cpe:2.3:a:powerdns:authoritative:3.4.0:::::::*
	cpe:2.3:a:powerdns:authoritative:3.4.1:::::::*
	cpe:2.3:a:powerdns:authoritative:3.4.3:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:20:::::::*
	cpe:2.3:o:fedoraproject:fedora:21:::::::*
	cpe:2.3:o:fedoraproject:fedora:22:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:powerdns:recursor:3.5:::::::*
	cpe:2.3:a:powerdns:recursor:3.6.0:::::::*
	cpe:2.3:a:powerdns:recursor:3.6.1:::::::*
	cpe:2.3:a:powerdns:recursor:3.6.2:::::::*
	cpe:2.3:a:powerdns:recursor:3.5.3:::::::*
	cpe:2.3:a:powerdns:recursor:3.6.3:::::::*
	cpe:2.3:a:powerdns:recursor:3.7.1:::::::*
	cpe:2.3:a:powerdns:recursor:3.5.2:::::::*
	cpe:2.3:a:powerdns:recursor:3.5.1:::::::*

Information

Published : 2015-05-18 08:59

Updated : 2016-12-27 18:59

NVD link : CVE-2015-1868

Mitre link : CVE-2015-1868

JSON object : View

CWE

CWE-399

Resource Management Errors

Products Affected

powerdns

authoritative
recursor

fedoraproject

fedora

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156725.html", "name": "FEDORA-2015-7031", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156743.html", "name": "FEDORA-2015-7018", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156655.html", "name": "FEDORA-2015-7033", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156667.html", "name": "FEDORA-2015-7057", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156648.html", "name": "FEDORA-2015-7079", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156680.html", "name": "FEDORA-2015-7047", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://www.securitytracker.com/id/1032220", "name": "1032220", "tags": ["Third Party Advisory"], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/74306", "name": "74306", "tags": ["Third Party Advisory"], "refsource": "BID"}, {"url": "http://www.debian.org/security/2015/dsa-3307", "name": "DSA-3307", "tags": [], "refsource": "DEBIAN"}, {"url": "http://www.debian.org/security/2015/dsa-3306", "name": "DSA-3306", "tags": [], "refsource": "DEBIAN"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-399"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-1868", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2015-05-18T15:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:powerdns:authoritative:3.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:authoritative:3.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:authoritative:3.3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:authoritative:3.3.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:authoritative:3.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:authoritative:3.4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:authoritative:3.4.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:powerdns:recursor:3.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:recursor:3.6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:recursor:3.6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:recursor:3.6.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:recursor:3.5.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:recursor:3.6.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:recursor:3.7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:recursor:3.5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:powerdns:recursor:3.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2016-12-28T02:59Z"}

7.8 /10