Sign-up

ID

VAR-201702-0037


CVE

CVE-2016-6173


TITLE

NSD Service disruption in (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2016-007717

DESCRIPTION

NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone transfer with unlimited data. Multiple DNS Servers are prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition, denying service to legitimate users

Trust: 1.89

sources: NVD: CVE-2016-6173 // JVNDB: JVNDB-2016-007717 // BID: 91678

AFFECTED PRODUCTS

vendor:nlnetlabsmodel:nsdscope:lteversion:4.1.10

Trust: 1.0

vendor:stichting nlnetmodel:nsdscope:ltversion:4.1.11

Trust: 0.8

vendor:nlnetlabsmodel:nsdscope:eqversion:4.1.10

Trust: 0.6

vendor:powerdnsmodel:authoritative serverscope:eqversion:3.4.7

Trust: 0.3

vendor:powerdnsmodel:authoritative serverscope:eqversion:3.4.6

Trust: 0.3

vendor:powerdnsmodel:authoritative serverscope:eqversion:3.4.5

Trust: 0.3

vendor:powerdnsmodel:authoritative serverscope:eqversion:3.4.4

Trust: 0.3

vendor:powerdnsmodel:authoritative serverscope:eqversion:3.4

Trust: 0.3

vendor:nsdmodel:nsdscope:eqversion:0

Trust: 0.3

vendor:knotmodel:dns knot dnsscope:eqversion:0

Trust: 0.3

vendor:powerdnsmodel:authoritative serverscope:neversion:4.0.0

Trust: 0.3

sources: BID: 91678 // JVNDB: JVNDB-2016-007717 // CNNVD: CNNVD-201607-081 // NVD: CVE-2016-6173

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6173
value: HIGH

Trust: 1.0

NVD: CVE-2016-6173
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201607-081
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2016-6173
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2016-6173
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: JVNDB: JVNDB-2016-007717 // CNNVD: CNNVD-201607-081 // NVD: CVE-2016-6173

PROBLEMTYPE DATA

problemtype:CWE-399

Trust: 1.8

sources: JVNDB: JVNDB-2016-007717 // NVD: CVE-2016-6173

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201607-081

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201607-081

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-007717

PATCH
title:Bug 790url:https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=790
Trust: 0.8
title:NSD RELEASE NOTESurl:http://www.nlnetlabs.nl/svn/nsd/tags/NSD_4_1_11_REL/doc/RELNOTES
Trust: 0.8
title:[nsd-users] NSD 4.1.11url:https://open.nlnetlabs.nl/pipermail/nsd-users/2016-August/002342.html
Trust: 0.8
title:NSD Remediation measures for denial of service vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62673
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-007717 // 
            
            
            
            CNNVD: CNNVD-201607-081

EXTERNAL IDS
db:NVDid:CVE-2016-6173
Trust: 2.7
db:OPENWALLid:OSS-SECURITY/2016/07/06/3
Trust: 1.6
db:OPENWALLid:OSS-SECURITY/2016/07/06/4
Trust: 1.6
db:BIDid:91678
Trust: 1.3
db:JVNDBid:JVNDB-2016-007717
Trust: 0.8
db:CNNVDid:CNNVD-201607-081
Trust: 0.6
sources:
            
            
            BID: 91678 // 
            
            
            
            JVNDB: JVNDB-2016-007717 // 
            
            
            
            CNNVD: CNNVD-201607-081 // 
            
            
            
            NVD: CVE-2016-6173

REFERENCES
url:https://github.com/sischkg/xfer-limit/blob/master/readme.md
Trust: 1.9
url:http://www.openwall.com/lists/oss-security/2016/07/06/3
Trust: 1.6
url:http://www.nlnetlabs.nl/svn/nsd/tags/nsd_4_1_11_rel/doc/relnotes
Trust: 1.6
url:http://www.openwall.com/lists/oss-security/2016/07/06/4
Trust: 1.6
url:https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=790
Trust: 1.6
url:https://lists.dns-oarc.net/pipermail/dns-operations/2016-july/015058.html
Trust: 1.6
url:https://open.nlnetlabs.nl/pipermail/nsd-users/2016-august/002342.html
Trust: 1.6
url:http://www.securityfocus.com/bid/91678
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6173
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6173
Trust: 0.8
url:https://github.com/powerdns/pdns/pull/4133
Trust: 0.3
url:https://lists.dns-oarc.net/pipermail/dns-operations/2016-july/015073.html
Trust: 0.3
sources:
            
            
            BID: 91678 // 
            
            
            
            JVNDB: JVNDB-2016-007717 // 
            
            
            
            CNNVD: CNNVD-201607-081 // 
            
            
            
            NVD: CVE-2016-6173

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 91678

SOURCES
db:BIDid:91678
db:JVNDBid:JVNDB-2016-007717
db:CNNVDid:CNNVD-201607-081
db:NVDid:CVE-2016-6173

LAST UPDATE DATE
2024-11-23T20:05:13.240000+00:00

SOURCES UPDATE DATE
db:BIDid:91678date:2016-07-07T00:00:00
db:JVNDBid:JVNDB-2016-007717date:2017-03-14T00:00:00
db:CNNVDid:CNNVD-201607-081date:2017-02-13T00:00:00
db:NVDid:CVE-2016-6173date:2024-11-21T02:55:36.120

SOURCES RELEASE DATE
db:BIDid:91678date:2016-07-07T00:00:00
db:JVNDBid:JVNDB-2016-007717date:2017-03-14T00:00:00
db:CNNVDid:CNNVD-201607-081date:2016-07-07T00:00:00
db:NVDid:CVE-2016-6173date:2017-02-09T15:59:01.237