Memory leak in PowerDNS Authoritative and PowerDNS Recursor - CVE-2018-10851

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU15960

Memory leak in PowerDNS Authoritative and PowerDNS Recursor - CVE-2018-10851

Published: November 12, 2018 / Updated: November 19, 2018


Vulnerability identifier: #VU15960
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-10851
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The vulnerability exists due to memory leak when handling malicious input. A remote attacker can insert a specially crafted record in a zone under his control, send a DNS query for that record, trigger memory leak and cause the service to crash.


Affected software

PowerDNS Authoritative
PowerDNS Recursor
Arch Linux
Fedora
Opensuse
Ubuntu
pdns (Alpine package)
pdns-recursor (Alpine package)
pdns-tools (Ubuntu package)
pdns-server (Ubuntu package)
pdns-recursor (Ubuntu package)
pdns
pdns-recursor

How to mitigate CVE-2018-10851

The vulnerability has been fixed in the versions 4.1.5.

PowerDNS Authoritative - update to 4.1.5
PowerDNS Recursor - update to 4.1.5
pdns (Alpine package) - addressed in versions 4.0.6-r0, 4.1.5-r0
pdns-recursor (Alpine package) - addressed in versions 4.0.9-r0, 4.1.8-r0
pdns-tools (Ubuntu package) - update to Ubuntu Pro
pdns-server (Ubuntu package) - update to Ubuntu Pro
pdns-recursor (Ubuntu package) - update to Ubuntu Pro
pdns - addressed in versions 4.0.6-2.el7, 4.1.5-1.fc27, 4.1.5-1.fc28, 4.1.5-1.fc29
pdns-recursor - addressed in versions 4.1.7-1.el7, 4.1.7-1.fc28, 4.1.7-1.fc29, 4.1.8-1.el7, 4.1.8-1.fc28, 4.1.8-1.fc29

External References

Related Security Bulletins