SB2019012427 - Arch Linux update for powerdns-recursor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019012427

SB2019012427 - Arch Linux update for powerdns-recursor

Published: January 24, 2019 Updated: February 1, 2019

Security Bulletin ID SB2019012427
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security restrictions bypass (CVE-ID: CVE-2019-3806)

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to Lua hooks are not properly applied to queries received over TCP in some specific combination of settings. A remote attacker can bypass security policies enforced using Lua.


2) Security restrictions bypass (CVE-ID: CVE-2019-3807)

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated. A remote attacker can bypass DNSSEC validation.


Remediation

Install update from vendor's website.

References