CVE-2017-15090 - CVE House

Back to Database

Status published Medium CVE-2017-15090

An issue has been found in the DNSSEC validation component...

5.9 CVSS

Vulnerability Description

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-15090

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from PowerDNS

View All →

Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor

Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor

Crafted delegations or IP fragments can poison cached delegations in Recursor

Crafted delegations or IP fragments can poison cached delegations in Recursor

A crafted zone can lead to an illegal memory access in the PowerDNS Recursor

Affected Vendor

PowerDNS

View all reports →

Affected Software

PowerDNS

Vulnerable Versions:

from 4.0.0 and up to and including 4.0.6

Timeline

Official Publish: January 23rd, 2018

Last Modified: September 16th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls

Defense Evasion

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1565 Data Manipulation