CVE-2016-7073 MEDIUM

CVE-2016-7073

Vendor Open-Xchange
Product pdns
Weakness CWE-20 · Input validation
Published September 11, 2018
Last update August 6, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever, leading to a possible replay attack.

Key dates

02Disclosure timeline

September 11, 2018 CVE published
August 6, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-49840 FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing CVE-2019-1806 Cisco Small Business Series Switches Simple Network Management Protocol Denial of Service Vulnerability CVE-2021-1140 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities CVE-2018-15412 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities CVE-2025-8097 WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation