CVE-2016-2120CWE-190

An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by…

High · published November 1, 2018

CVSS v3.0
7.5
EPSS
2%
Percentile
80.5
In the wild
Unconfirmed
What it is

An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record. The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01997 · 80.5th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2018-11-01T13:00Z
EPSS history
Timeline
  • 01 NOV 13:00Z
    An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by…
    cvelistv5