OpenSUSE Linux update for pdns-recursor



Published: 2020-10-17
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE ID CVE-2020-14196
CVE-2020-25829
CWE ID CWE-284
CWE-20
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
Subscribe
Opensuse
Operating systems & Components / Operating system

SUSE Linux
Operating systems & Components / Operating system

SUSE Package Hub for SUSE Linux Enterprise
Universal components / Libraries / Libraries used by multiple products

Vendor Novell
SuSE

Security Advisory

1) Improper access control

Risk: Medium

CVSSv3: 4.3 [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-14196

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to  ACL applied to the internal web server via "webserver-allow-from" is not properly enforced. A remote attacker can send HTTP queries to the internal web server, bypassing the restriction.

Successful exploitation of the vulnerability requires that the the API webserver is enabled (not the default value).

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1, 15.2

SUSE Package Hub for SUSE Linux Enterprise: 12

SUSE Linux: 15

CPE External links

https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00037.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Input validation error

Risk: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-25829

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cache poisoning attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause the cached records for a given name to be updated to the ‘Bogus’ DNSSEC validation state, instead of their actual DNSSEC ‘Secure’ state, via a DNS ANY query. This results in a denial of service for installations that always validate (dnssec=validate) and for clients requesting validation when on-demand validation is enabled (dnssec=process).

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1, 15.2

SUSE Package Hub for SUSE Linux Enterprise: 12

SUSE Linux: 15

CPE External links

https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00037.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.