CVE-2016-7072

2018-09-1017:00:00

CWE-20

redhat

www.cve.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.3 High

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

83.4%

JSON

An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it’s more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.

CNA Affected

[
  {
    "product": "pdns",
    "vendor": "Open-Xchange",
    "versions": [
      {
        "status": "affected",
        "version": "3.4.11"
      },
      {
        "status": "affected",
        "version": "4.0.2"
      }
    ]
  }
]