Input validation error in PowerDNS Recursor - CVE-2009-4010
Published: October 10, 2018 / Updated: June 21, 2025
Vulnerability identifier: #VU111727
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2009-4010
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Unspecified vulnerability in PowerDNS Recursor before 3.1.7.2 allows remote attackers to spoof DNS data via crafted zones.
Affected software
PowerDNS Recursor
Gentoo Linux
Fedora
pdns-recursor
net-dns/pdns-recursor
Gentoo Linux
Fedora
pdns-recursor
net-dns/pdns-recursor
How to mitigate CVE-2009-4010
Install update from vendor's website.
PowerDNS Recursor - update to 3.1.7.2
pdns-recursor - update to 3.1.7.2-1.el5
net-dns/pdns-recursor - update to 3.6.1-r1
pdns-recursor - update to 3.1.7.2-1.el5
net-dns/pdns-recursor - update to 3.6.1-r1
External References
- http://doc.powerdns.com/powerdns-advisory-2010-02.html
- http://secunia.com/advisories/38004
- http://secunia.com/advisories/38068
- http://securitytracker.com/id?1023404
- http://www.securityfocus.com/archive/1/508743/100/0/threaded
- http://www.securityfocus.com/bid/37653
- http://www.vupen.com/english/advisories/2010/0054
- https://bugzilla.redhat.com/show_bug.cgi?id=552285
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55439
- https://www.redhat.com/archives/fedora-package-announce/2010-January/msg00217.html
- https://www.redhat.com/archives/fedora-package-announce/2010-January/msg00228.html