SB2018111208 - Arch Linux update for powerdns

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018111208

SB2018111208 - Arch Linux update for powerdns

Published: November 19, 2018 Updated: November 19, 2018

Security Bulletin ID SB2018111208
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Memory leak (CVE-ID: CVE-2018-10851)

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The vulnerability exists due to memory leak when handling malicious input. A remote attacker can insert a specially crafted record in a zone under his control, send a DNS query for that record, trigger memory leak and cause the service to crash.


2) Improper input validation (CVE-ID: CVE-2018-14626)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to DNSSEC validating clients consider the answer to be bogus until it expires from the packet cache. A remote attacker can craft a DNS query, cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype.


Remediation

Install update from vendor's website.

References