CVE-2017-15094

Description

An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default).

CVSS Metrics

• v3.0•MEDIUM•Score: 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.00%• Percentile: 0%

Techniques & Countermeasures

• CWE-772•Missing Release of Resource after Effective Lifetime

  The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

• CWE-401•Missing Release of Memory after Effective Lifetime

  The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Systems

• powerdns•powerdns_recursor

  from 4.0.0 up to and including 4.0.6

• powerdns•recursor

  ≥ 4.0.0, ≤ 4.0.6

References (2)

• https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-07.html
• http://www.securityfocus.com/bid/101982