CVE-2016-6173 NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone transfer with unlimited data.
HighCVSS 7.5
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone transfer with unlimited data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nsd(Debian:12) | < 4.1.11-1 | 4.1.11-1 |
| debian/nsd(Debian:13) | < 4.1.11-1 | 4.1.11-1 |
| debian/nsd(Debian:14) | < 4.1.11-1 | 4.1.11-1 |
| nlnetlabs nsd | <= 4.1.10 | No fix listed |
References
- Debian Security Tracker CVE-2016-6173 vendor-advisory
- www.nlnetlabs.nl release-notes vendor-advisory
- [oss-security] 20160706 Malicious primary DNS servers can crash secondaries mailing-list third-party-advisory
- [oss-security] 20160706 Re: Malicious primary DNS servers can crash secondaries mailing-list third-party-advisory
- 91678 third-party-advisory vdb-entry
- github.com third-party-advisory
- [dns-operations] 20160704 DNS activities in Japan mailing-list third-party-advisory
- [nsd-users] 20160809 NSD 4.1.11 mailing-list release-notes vendor-advisory
- www.nlnetlabs.nl issue-tracking
- bugs.debian.org issue-tracking