CVE-2016-7073CWE-20

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter…

Medium · published September 11, 2018

CVSS v3.0
5.3
EPSS
1%
Percentile
68.6
In the wild
Unconfirmed
What it is

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever, leading to a possible replay attack.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01233 · 68.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-09-11T13:00Z
EPSS history
Timeline
  • 11 SEP 13:00Z
    An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter…
    cvelistv5