SB2019020106 - Security restrictions bypass in PowerDNS Recursor

Description

This security bulletin contains information about 2 vulnerabilities.

1) Security restrictions bypass (CVE-ID: CVE-2019-3806)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to Lua hooks are not properly applied to queries received over TCP in some specific combination of settings. A remote attacker can bypass security policies enforced using Lua.

2) Security restrictions bypass (CVE-ID: CVE-2019-3807)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated. A remote attacker can bypass DNSSEC validation.

Remediation

Install update from vendor's website.

References

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-02.html