CVE-2015-5470
NoneCVSS
—
EPSS
11.3%
Published
Nov 2, 2015
CISA due date
—
The record
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | pdns | 0 | 3.4.5-1 |
| Debian:11 | pdns-recursor | 0 | 3.7.3-1 |
| Debian:12 | pdns | 0 | 3.4.5-1 |
| Debian:12 | pdns-recursor | 0 | 3.7.3-1 |
| Debian:13 | pdns | 0 | 3.4.5-1 |
| Debian:13 | pdns-recursor | 0 | 3.7.3-1 |
| Debian:8 | pdns | 0 | 3.4.1-4+deb8u2 |
| Debian:8 | pdns-recursor | 0 | 3.6.2-2+deb8u2 |
| Mageia:4 | pdns | 0 | 3.3.3-1.mga4 |
| Mageia:4 | pdns-recursor | 0 | 3.6.4-1.mga4 |
| Mageia:5 | pdns | 0 | 3.3.3-1.mga5 |
| Mageia:5 | pdns-recursor | 0 | 3.6.4-1.mga5 |
| Ubuntu:14.04:LTS | pdns-recursor | 0 | 3.5.3-1ubuntu0.1 |
| Ubuntu:16.04:LTS | pdns-recursor | 0 | 3.7.3-1 |
Related vulnerabilities
- CVE-2016-5427 PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . Also affects pdns
- CVE-2016-5426 PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a… Also affects pdns
- CVE-2015-5311 PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to… Also affects pdns
- CVE-2015-1868 The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and… Also affects pdns
- CVE-2024-25590 An attacker can publish a zone containing specific Resource Record Sets. Also affects pdns-recursor
- CVE-2023-50868 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… Also affects pdns-recursor
- CVE-2014-8601 PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote… Also affects pdns-recursor
- CVE-2009-4009 Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a… Also affects pdns-recursor