CVE-2016-7068

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-400

Affected software

Vendor	Product	Versions
Open-Xchange	pdns	3.4.11; 4.0.2; 3.7.4; 4.0.4

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7068Issue Tracking, Third Party Advisory
https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/Vendor Advisory
https://www.debian.org/security/2017/dsa-3763Third Party Advisory
https://www.debian.org/security/2017/dsa-3764Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7068Issue Tracking, Third Party Advisory
https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/Vendor Advisory
https://www.debian.org/security/2017/dsa-3763Third Party Advisory
https://www.debian.org/security/2017/dsa-3764Third Party Advisory

Timeline

Published: Sep 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70697.5An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist CVE-2016-70708.0A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures CVE-2016-70718.8It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote CVE-2016-70727.5An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a deni CVE-2016-70735.9An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-CVE-2016-70745.9An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-CVE-2016-70758.1It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fi CVE-2016-70767.8sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C libra CVE-2016-70774.3foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated CVE-2016-70784.3foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_CVE-2016-70797.8The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial CVE-2016-70807.8The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial