CVE-2006-4252: Medium severity powerdns recursor vulnerability
Published Nov 14, 2006
·Updated
PowerDNS Recursor 3.1.3 and earlier allows remote attackers to cause a denial of service (resource exhaustion and application crash) via a CNAME record with a zero TTL, which triggers an infinite loop.
Affected Software
12 affected components
powerdns recursor=3.1
powerdns recursor=2.9.18
powerdns recursor=2.0_rc1
powerdns recursor=3.1.2
powerdns recursor=3.0
powerdns recursor<=3.1.3
powerdns recursor=2.9.15
powerdns recursor=3.1.1
powerdns recursor=3.0.1
powerdns recursor=2.9.17
powerdns recursor=2.8
powerdns recursor=2.9.16
Remediation
Patch Available
Patch Available
Patch Available
Event History
Nov 14, 2006
CVE Published
08:07 PM
Data Sourced
via NVD·08:07 PM
RemedyDescriptionSeverityAffected Software
Nov 15, 2006
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-4252?
CVE-2006-4252 is classified as a high severity vulnerability that can lead to denial of service.
2
How do I fix CVE-2006-4252?
To mitigate CVE-2006-4252, update PowerDNS Recursor to version 3.1.4 or later.
3
What types of attacks does CVE-2006-4252 allow?
CVE-2006-4252 allows remote attackers to exploit a CNAME record with a zero TTL, causing resource exhaustion and application crashes.
4
Which versions of PowerDNS are affected by CVE-2006-4252?
CVE-2006-4252 affects PowerDNS Recursor versions up to and including 3.1.3 and several earlier versions.
5
What is the impact of exploiting CVE-2006-4252?
Exploiting CVE-2006-4252 can result in an infinite loop leading to application crashes and denial of service.