Detections
Analytics
Alpine: multiple pdns-recursor packages: security update to 4.0.4-r0
medium Tenable Cloud Security Plugin ID 406248
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4,
allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by
sending crafted DNS queries, which might result in a partial denial of service if the system becomes
overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query
regardless of whether they are needed or even legitimate. A specially crafted query containing a large
number of records can be used to take advantage of that behaviour. (CVE-2016-7068)
- An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing
an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient
validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in
AXFRRetriever, leading to a possible replay attack. (CVE-2016-7073)
- An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing
an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient
validation of TSIG signatures. A missing check that the TSIG record is the last one, leading to the
possibility of parsing records that are not covered by the TSIG signature. (CVE-2016-7074)
See Also
https://security.alpinelinux.org/vuln/CVE-2016-7068
Plugin Details
Severity: Medium
ID: 406248
Version: Revision 1.25
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2016-7074
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 12/15/2016