PowerDNS: Multiple vulnerabilities

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200812-19 / pdns
Release Date	December 19, 2008
Latest Revision	December 19, 2008: 01
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
net-dns/pdns	< 2.9.21.2	>= 2.9.21.2	All supported architectures

Related bugreports: #234032, #247079

Synopsis

Two vulnerabilities have been discovered in PowerDNS, possibly leading to a Denial of Service and easing cache poisoning attacks.

2. Impact Information

Background

The PowerDNS Nameserver is an authoritative-only nameserver which uses a flexible backend architecture.

Description

Daniel Drown reported an error when receiving a HINFO CH query (CVE-2008-5277). Brian J. Dowling of Simplicity Communications discovered a previously unknown security implication of the PowerDNS behavior to not respond to certain queries it considers malformed (CVE-2008-3337).

Impact

A remote attacker could send specially crafted queries to cause a Denial of Service. The second vulnerability in itself does not pose a security risk to PowerDNS Nameserver. However, not answering a query for an invalid DNS record within a valid domain allows for a larger spoofing window on third-party nameservers for domains being hosted by PowerDNS Nameserver itself.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All PowerDNS users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dns/pdns-2.9.21.2"

4. References

Page updated December 19, 2008

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.