PowerDNS Authoritative Server up to 4.0.7/4.1.8 NOTIFY Message CPU Exhaustion denial of service

A vulnerability has been found in PowerDNS Authoritative Server up to 4.0.7/4.1.8 (Domain Name Software) and classified as problematic. This vulnerability affects some unknown functionality of the component NOTIFY Message Handler. The manipulation with an unknown input leads to a denial of service vulnerability (CPU Exhaustion). The CWE definition for the vulnerability is CWE-400. As an impact it is known to affect availability.

The weakness was released 07/30/2019. The advisory is shared for download at blog.powerdns.com. This vulnerability was named CVE-2019-10163 since 03/27/2019. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 4.0.8 or 4.1.9 eliminates this vulnerability.

Entry connected to this vulnerability is available at 139035.

Type

Vendor

Name

VulDB Meta Base Score: 4.3
VulDB Meta Temp Score: 4.1

VulDB Base Score: ≈4.3
VulDB Temp Score: ≈4.1
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Denial of service / CPU Exhaustion (CWE-400)
Local: No
Remote: Yes

Availability: 🔒
Status: Not defined

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: Authoritative Server 4.0.8/4.1.9

03/27/2019 CVE assigned
07/30/2019 +125 days Advisory disclosed
07/31/2019 +1 days VulDB entry created
07/31/2019 +0 days VulDB last updateAdvisory: blog.powerdns.com

CVE: CVE-2019-10163 (🔒)
See also: 🔒

Created: 07/31/2019 09:53 AM
Complete: 🔍

Comments are closed.