CVE-2016-7073

2018-09-1113:00:00

CWE-20

redhat

www.cve.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.0%

JSON

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever, leading to a possible replay attack.

CNA Affected

[
  {
    "product": "pdns",
    "vendor": "Open-Xchange",
    "versions": [
      {
        "status": "affected",
        "version": "3.4.11"
      },
      {
        "status": "affected",
        "version": "4.0.2"
      },
      {
        "status": "affected",
        "version": "4.0.4"
      }
    ]
  }
]