ArchLinux: 201701-30: powerdns-recursor: multiple issues
Summary
- CVE-2016-7068 (denial of service)
An issue has been found in PowerDNS allowing a remote, unauthenticated
attacker to cause an abnormal CPU usage load on the PowerDNS server by
sending crafted DNS queries, which might result in a partial denial of
service if the system becomes overloaded. This issue is based on the
fact that the PowerDNS server parses all records present in a query
regardless of whether they are needed or even legitimate. A specially
crafted query containing a large number of records can be used to take
advantage of that behaviour.
- CVE-2016-7073 (insufficient validation)
An issue has been found in PowerDNS Authoritative Server and PowerDNS
Recursor allowing an attacker in position of man-in-the-middle to alter
the content of an AXFR because of insufficient validation of TSIG
signatures. A missing check of the TSIG time and fudge values in
AXFRRetriever, leading to a possible replay attack.
- CVE-2016-7074 (insufficient validation)
An issue has been found in PowerDNS Authoritative Server and PowerDNS
Recursor allowing an attacker in position of man-in-the-middle to alter
the content of an AXFR because of insufficient validation of TSIG
signatures. A missing check that the TSIG record is the last one,
leading to the possibility of parsing records that are not covered by
the TSIG signature.
Resolution
Upgrade to 4.0.4-1.
# pacman -Syu "powerdns-recursor>=4.0.4-1"
The problems have been fixed upstream in version 4.0.4.
References
https://seclists.org/oss-sec/2017/q1/97 https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/ https://security.archlinux.org/CVE-2016-7068 https://security.archlinux.org/CVE-2016-7073 https://security.archlinux.org/CVE-2016-7074
Workaround
None.