Improper input validation in pdns-recursor (Alpine package)

1) Improper input validation

EUVDB-ID: #VU15962

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14644

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to an error if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for at least one of the meta-types. A remote attacker can send a DNS query for a meta-type like OPT, lead to a zone being wrongly cached as failing DNSSEC validation and cause subsequent queries from clients to request DNSSEC validation answered with a ServFail.

Mitigation

Install update from vendor's website.

Vulnerable software versions

pdns-recursor (Alpine package): 4.0.4-r0 - 4.1.3-r0

External links

http://git.alpinelinux.org/aports/commit/?id=25d9fe89a4cbd43e9f7cc3e4f9c28cf372f28c57
http://git.alpinelinux.org/aports/commit/?id=08ec10f083f3eb9549ad5efb4acdbe2c313bc4c2
http://git.alpinelinux.org/aports/commit/?id=a82df6a94c042f4bf27b6d162cda7fb7d7f513b5
http://git.alpinelinux.org/aports/commit/?id=d4b0f51ac1e8c9d50821593f4982da6bdb1c68a5
http://git.alpinelinux.org/aports/commit/?id=0756f3f95a7b96bfe212a78d42d64da35b03a78a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.