SB2018111911 - Denial of service vulnerabilities in PowerDNS Recursor and Authoritative
Published: November 19, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Memory leak (CVE-ID: CVE-2018-10851)
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The vulnerability exists due to memory leak when handling malicious input. A remote attacker can insert a specially crafted record in a zone under his control, send a DNS query for that record, trigger memory leak and cause the service to crash.
2) Improper input validation (CVE-ID: CVE-2018-14626)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to DNSSEC validating clients consider the answer to be bogus until it expires from the packet cache. A remote attacker can craft a DNS query, cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype.
3) Improper input validation (CVE-ID: CVE-2018-14644)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to an error if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for at least one of the meta-types. A remote attacker can send a DNS query for a meta-type like OPT, lead to a zone being wrongly cached as failing DNSSEC validation and cause subsequent queries from clients to request DNSSEC validation answered with a ServFail.
Remediation
Install update from vendor's website.