oss-sec mailing list archives
PowerDNS Security Advisories 2011-01 and 2019-02
From: Remi Gacogne <remi.gacogne () powerdns com>
Date: Mon, 21 Jan 2019 15:23:11 +0100
Hi all, We just released PowerDNS Recursor 4.1.9 fixing two security issues: - PowerDNS Security Advisory 2019-01 (CVE-2019-3806): Lua hooks are not called over TCP - PowerDNS Security Advisory 2019-02 (CVE-2019-3807): DNSSEC validation is not performed for AA=0 responses These issues respectively affect PowerDNS Recursor from 4.1.4 and 4.1.0, up to and including 4.1.8. PowerDNS Recursor 4.0.x and below are not affected. The full security advisories are provided below, and can also be found at: - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-02.html Minimal patches are available at [1] and [2]. [1]: https://downloads.powerdns.com/patches/2019-01/ [2]: https://downloads.powerdns.com/patches/2019-02/ Best regards, Remi PowerDNS Security Advisory 2019-01: Lua hooks are not applied in certain configurations ======================================================================== - CVE: CVE-2019-3806 - Date: 21st of January 2019 - Affects: PowerDNS Recursor from 4.1.4 up to and including 4.1.8 - Not affected: 4.0.x, 4.1.0 up to and including 4.1.3, 4.1.9 - Severity: Low - Impact: Access restriction bypass - Exploit: This problem can be triggered via TCP queries - Risk of system compromise: No - Solution: Upgrade to a non-affected version - Workaround: Switch to pdns-distributes-queries=no An issue has been found in PowerDNS Recursor where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua. When the recursor is configured to run with more than one thread (threads=X) and to do the distribution of incoming queries to the worker threads itself (pdns-distributes-queries=yes), the Lua script is not properly loaded in the thread handling incoming TCP queries, causing the Lua hooks to not be properly applied. This issue has been assigned CVE-2019-3806 by Red Hat. PowerDNS Recursor from 4.1.4 up to and including 4.1.8 is affected. PowerDNS Security Advisory 2019-02: Insufficient validation of DNSSEC signatures ===================================================================== - CVE: CVE-2019-3807 - Date: 21st of January 2019 - Affects: PowerDNS Recursor from 4.1.0 up to and including 4.1.8 - Not affected: 4.0.x, 4.1.9 - Severity: Medium - Impact: Insufficient validation - Exploit: This problem can be triggered via crafted responses - Risk of system compromise: No - Solution: Upgrade to a non-affected version An issue has been found in PowerDNS Recursor where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation. This issue has been assigned CVE-2019-3807 by Red Hat. PowerDNS Recursor from 4.1.0 up to and including 4.1.8 is affected. We would like to thank Ralph Dolmans and George Thessalonikefs of NLNetLabs for finding and subsequently reporting this issue!
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- PowerDNS Security Advisories 2011-01 and 2019-02 Remi Gacogne (Jan 21)