oss-sec mailing list archives
PowerDNS Security Advisories 2016-02, 2016-03, 2016-04 and 2016-05
From: Remi Gacogne <remi.gacogne () powerdns com>
Date: Sun, 15 Jan 2017 13:26:43 +0100
Hi all, Several security issues of medium severity have been recently reported to us, and we just released new versions of PowerDNS Authoritative Server and PowerDNS Recursor addressing them: - 2016-02: Crafted queries can cause abnormal CPU usage: CVE-2016-7068 - 2016-03: Denial of service via the web server: CVE-2016-7072 - 2016-04: Insufficient validation of TSIG signatures: CVE-2016-7073 CVE-2016-7074 - 2016-05: Crafted zone record can cause a denial of service: CVE-2016-2120 This matrix shows the versions affected by these issues: | | 2016-02 | 2016-03 | 2016-04 | 2016-05 | | --- | --- | --- | --- | --- | | Recursor 3.6 | Yes | | | | | Recursor 3.7 | Yes | | | | | Recursor 4.0 | Yes | | Yes | | | Authoritative 3.3 | Yes | Yes | Yes | Yes | | Authoritative 3.4 | Yes | Yes | Yes | Yes | | Authoritative 4.0 | Yes | Yes | Yes | Yes | The full security advisories are provided below, and can also be found at: - https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ - https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/ - https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/ - https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/ Minimal patches are available for those unable to fully upgrade: - https://downloads.powerdns.com/patches/2016-02/ - https://downloads.powerdns.com/patches/2016-03/ - https://downloads.powerdns.com/patches/2016-04/ - https://downloads.powerdns.com/patches/2016-05/ Please note that for the Authoritative Server 3.3 and the Recursor 3.6 series, we will only publish these patches. We also urge all users of these versions to migrate to the 4.X release trains. Please feel free to contact me directly if you have any question. - PowerDNS Security Advisory 2016-02: Crafted queries can cause abnormal CPU usage CVE: CVE-2016-7068 Date: December 15th 2016 Credit: Florian Heinz and Martin Kluge Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1, PowerDNS Recursor up to and including 3.7.3, 4.0.3 Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2 and PowerDNS Recursor 3.7.4, 4.0.4 Severity: Medium Impact: Degraded service or Denial of service Exploit: This issue can be triggered by sending specially crafted query packets Risk of system compromise: No Solution: Upgrade to a non-affected version Workaround: Run dnsdist with the rules provided below in front of potentially affected servers. An issue has been found in PowerDNS allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour. This issue has been assigned CVE-2016-7068. PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. PowerDNS Recursor up to and including 3.7.3 and 4.0.3 are affected. dnsdist can be used to block crafted queries, using RecordsCountRule() and RecordsTypeCountRule() to block queries with crafted records. We would like to thank Florian Heinz and Martin Kluge for finding and subsequently reporting this issue. - PowerDNS Security Advisory 2016-03: Denial of service via the web server CVE: CVE-2016-7072 Date: December 15th 2016 Credit: Mongo Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1 Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2 Severity: Medium Impact: Degraded service or Denial of service Exploit: This issue can be triggered by opening a large number of simultaneous connections to the web server Risk of system compromise: No Solution: Upgrade to a non-affected version Workaround: Disable the web server, or restrict access to it via a firewall. An issue has been found in PowerDNS Authoritative Server allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible. This issue has been assigned CVE-2016-7072. PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. The PowerDNS Recursor is not affected. We would like to thank Mongo for finding and subsequently reporting this issue. - PowerDNS Security Advisory 2016-04: Insufficient validation of TSIG signatures CVE: CVE-2016-7073 CVE-2016-7074 Date: December 15th 2016 Credit: Mongo Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1, PowerDNS Recursor from 4.0.0 and up to and including 4.0.3 Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2, PowerDNS Recursor < 4.0.0, 4.0.4 Severity: Medium Impact: Zone content alteration Exploit: This problem can be triggered by an attacker in position of man-in-the-middle Risk of system compromise: No Solution: Upgrade to a non-affected version Two issues have been found in PowerDNS Authoritative Server allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. The first issue is a missing check of the TSIG time and fudge values in AXFRRetriever, leading to a possible replay attack. This issue has been assigned CVE-2016-7073. The second issue is a missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature. This issue has been assigned CVE-2016-7074. PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. PowerDNS Recursor from 4.0.0 up to and including 4.0.3 are affected. We would like to thank Mongo for finding and subsequently reporting this issue. - PowerDNS Security Advisory 2016-05: Crafted zone record can cause a denial of service CVE: CVE-2016-2120 Date: December 15th 2016 Credit: Mathieu Lafon Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1 Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2 Severity: Medium Impact: Denial of service Exploit: This issue can be triggered by inserting a specially crafted record in a zone Risk of system compromise: No Solution: Upgrade to a non-affected version An issue has been found in PowerDNS Authoritative Server allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record. The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary. This issue has been assigned CVE-2016-2120. PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. The PowerDNS Recursor is not affected. We would like to thank Mathieu Lafon for finding and subsequently reporting this issue. -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- PowerDNS Security Advisories 2016-02, 2016-03, 2016-04 and 2016-05 Remi Gacogne (Jan 15)