PowerDNS: Multiple vulnerabilities
Gentoo Linux Security Advisory
||GLSA 200812-19 / pdns
||December 19, 2008
||December 19, 2008: 01
All supported architectures
Two vulnerabilities have been discovered in PowerDNS, possibly leading to a
Denial of Service and easing cache poisoning attacks.
The PowerDNS Nameserver is an authoritative-only nameserver which uses
a flexible backend architecture.
Daniel Drown reported an error when receiving a HINFO CH query
(CVE-2008-5277). Brian J. Dowling of Simplicity Communications
discovered a previously unknown security implication of the PowerDNS
behavior to not respond to certain queries it considers malformed
A remote attacker could send specially crafted queries to cause a
Denial of Service. The second vulnerability in itself does not pose a
security risk to PowerDNS Nameserver. However, not answering a query
for an invalid DNS record within a valid domain allows for a larger
spoofing window on third-party nameservers for domains being hosted by
PowerDNS Nameserver itself.
There is no known workaround at this time.
All PowerDNS users should upgrade to the latest version:
Code Listing 3.1: Resolution
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dns/pdns-220.127.116.11"