Input validation error in PowerDNS Recursor - CVE-2020-10995

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28141

Input validation error in PowerDNS Recursor - CVE-2020-10995

Published: May 20, 2020


Vulnerability identifier: #VU28141
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10995
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing DNS responses. A remote attacker who controls a malicious DNS server can send a specially crafted response and perform a denial of service (DoS) attack against third-party DNS servers.

The attack is triggered by random subdomains in the NSDNAME in NS records.


Affected software

PowerDNS Recursor
Arch Linux
Fedora
SUSE Linux
Opensuse
SUSE Package Hub for SUSE Linux Enterprise
pdns-recursor (Alpine package)
pdns-recursor (Debian package)
pdns-recursor

How to mitigate CVE-2020-10995

Install updates from vendor's website.

PowerDNS Recursor - addressed in versions 4.1.16, 4.2.2, 4.3.1
pdns-recursor (Alpine package) - update to 4.1.16-r0
pdns-recursor (Debian package) - update to 4.1.11-1+deb10u1
pdns-recursor - addressed in versions 4.1.16-1.el7, 4.2.2-1.el8, 4.2.2-1.fc31, 4.3.1-1.fc32

External References

Related Security Bulletins