Memory Leak in PowerDNS Recursor due to DNSSEC Parsing Flaw
CVE-2017-15094

5.9MEDIUM

Key Information:

Vendor

Powerdns

Status
Powerdns Recursor
Vendor
CVE Published:
23 January 2018

What is CVE-2017-15094?

A vulnerability in the DNSSEC parsing mechanism of PowerDNS Recursor (versions 4.0.0 through 4.0.6) allows for the potential exploitation through specially crafted DNSSEC ECDSA keys. This memory leak issue occurs specifically when DNSSEC validation is enabled, creating a risk during the handling of DNS requests that utilize non-default validation settings.

Affected Version(s)

PowerDNS Recursor from 4.0.0 up to and including 4.0.6

References

https://doc.powerdns.com/recursor/security-advisories/pow...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/101982
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.