Denial of service vulnerabilities in PowerDNS Recursor and Authoritative
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2018-10851 CVE-2018-14626 CVE-2018-14644 |
| CWE-ID | CWE-401 CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
PowerDNS Recursor Server applications / DNS servers PowerDNS Authoritative Server applications / DNS servers |
| Vendor | PowerDNS.COM B.V. |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Memory leak
EUVDB-ID: #VU15960
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-10851
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The vulnerability exists due to memory leak when handling malicious input. A remote attacker can insert a specially crafted record in a zone under his control, send a DNS query for that record, trigger memory leak and cause the service to crash.
Mitigation
The vulnerability has been fixed in the versions 4.1.5.
Vulnerable software versionsPowerDNS Recursor: 4.0.0 - 4.1.4
PowerDNS Authoritative: 4.0.0 - 4.1.4
External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=1649032
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper input validation
EUVDB-ID: #VU15961
Risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-14626
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to DNSSEC validating clients consider the answer to be bogus until it expires from the packet cache. A remote attacker can craft a DNS query, cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype.
MitigationThe vulnerability has been fixed in the versions 4.1.5.
Vulnerable software versionsPowerDNS Recursor: 4.0.0 - 4.1.4
PowerDNS Authoritative: 4.0.0 - 4.1.4
External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=1649028
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper input validation
EUVDB-ID: #VU15962
Risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-14644
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to an error if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for at least one of the meta-types. A remote attacker can send a DNS query for a meta-type like OPT, lead to a zone being wrongly cached as failing DNSSEC validation and cause subsequent queries from clients to request DNSSEC validation answered with a ServFail.
MitigationThe vulnerability has been fixed in the versions 4.1.5.
Vulnerable software versionsPowerDNS Recursor: 4.0.0 - 4.1.4
External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14644
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
