Vulnerability Name:

CVE-2018-1000003 (CCN-138115)

Assigned:2018-01-22
Published:2018-01-22
Updated:2018-02-06
Summary:Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.
CVSS v3 Severity:3.7 Low (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
3.2 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-20
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2018-1000003

Source: CCN
Type: PowerDNS Security Advisory 2018-01
Insufficient validation of DNSSEC signatures

Source: CONFIRM
Type: Vendor Advisory
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html

Source: XF
Type: UNKNOWN
powerdns-cve20181000003-dos(138115)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2018-1000003

Vulnerable Configuration:Configuration 1:
  • cpe:/a:powerdns:recursor:4.1.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:powerdns:recursor:4.1.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20181000003
    V
    		CVE-2018-1000003
    2022-06-30
    oval:org.opensuse.security:def:113104
    P
    		pdns-recursor-4.5.5-1.3 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106539
    P
    		pdns-recursor-4.5.5-1.3 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:25745
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:25255
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:25599
    P
    		Security update for apache2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:24983
    P
    		Security update for spamassassin (Important)
    2020-12-01
    oval:org.opensuse.security:def:26383
    P
    		Security update for Mozilla Thunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25312
    P
    		Security update for libsolv (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25687
    P
    		Security update for bluez (Important)
    2020-12-01
    oval:org.opensuse.security:def:25047
    P
    		Security update for sysstat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26418
    P
    		Security update for pdns-recursor (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25396
    P
    		Security update for perl-DBI (Important)
    2020-12-01
    oval:org.opensuse.security:def:25701
    P
    		Security update for libexif (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25174
    P
    		Security update for tomcat (Important)
    2020-12-01
    oval:org.opensuse.security:def:25546
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:24972
    P
    		Security update for xrdp (Important)
    2020-12-01
    oval:com.ubuntu.bionic:def:201810000030000000
    V
    		CVE-2018-1000003 on Ubuntu 18.04 LTS (bionic) - untriaged.
    2018-01-22
    oval:com.ubuntu.artful:def:20181000003000
    V
    		CVE-2018-1000003 on Ubuntu 17.10 (artful) - untriaged.
    2018-01-22
    oval:com.ubuntu.xenial:def:20181000003000
    V
    		CVE-2018-1000003 on Ubuntu 16.04 LTS (xenial) - untriaged.
    2018-01-22
    oval:com.ubuntu.xenial:def:201810000030000000
    V
    		CVE-2018-1000003 on Ubuntu 16.04 LTS (xenial) - untriaged.
    2018-01-22
    oval:com.ubuntu.bionic:def:20181000003000
    V
    		CVE-2018-1000003 on Ubuntu 18.04 LTS (bionic) - untriaged.
    2018-01-22
    oval:com.ubuntu.disco:def:201810000030000000
    V
    		CVE-2018-1000003 on Ubuntu 19.04 (disco) - untriaged.
    2018-01-22
    oval:com.ubuntu.cosmic:def:20181000003000
    V
    		CVE-2018-1000003 on Ubuntu 18.10 (cosmic) - untriaged.
    2018-01-22
    oval:com.ubuntu.cosmic:def:201810000030000000
    V
    		CVE-2018-1000003 on Ubuntu 18.10 (cosmic) - untriaged.
    2018-01-22
    oval:com.ubuntu.trusty:def:20181000003000
    V
    		CVE-2018-1000003 on Ubuntu 14.04 LTS (trusty) - untriaged.
    2018-01-22
    BACK
    powerdns recursor 4.1.0
    powerdns recursor 4.1.0