CVE-2024-25581— Transfer requests received over DoH can lead to a denial of service in DNSdist
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-25581
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Transfer requests received over DoH can lead to a denial of service in DNSdist
Source: NVD (National Vulnerability Database)
Vulnerability Description
When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
PowerDNS DNSdist 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PowerDNS DNSDist是荷兰PowerDNS公司的一款负载均衡器。该产品能够将流量分流到不同服务器，为用户提供最佳性能。 PowerDNS DNSdist 1.9.4之前版本存在安全漏洞，该漏洞源于攻击者可以通过发送区域传输请求来触发断言失败，从而导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-25581
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-25581
请登录查看更多情报信息。
IV. Related Vulnerabilities
V. Comments for CVE-2024-25581
No comments yet