Linux Security
    Linux Security
    Linux Security

    Mageia 2020-0375: pdns security update

    Date
    77
    Posted By
    An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify
    MGASA-2020-0375 - Updated pdns packages fix security vulnerability
    
    Publication date: 27 Sep 2020
    URL: https://advisories.mageia.org/MGASA-2020-0375.html
    Type: security
    Affected Mageia releases: 7
    CVE: CVE-2019-10162,
         CVE-2019-10163,
         CVE-2019-10203,
         CVE-2020-17482
    
    An issue has been found in PowerDNS Authoritative Server allowing an
    authorized user to cause the server to exit by inserting a crafted record in a
    MASTER type zone under their control. The issue is due to the fact that the
    Authoritative Server will exit when it runs into a parsing error while looking
    up the NS/A/AAAA records it is about to use for an outgoing notify
    (CVE-2019-10162).
    
    An issue has been found in PowerDNS Authoritative Server allowing a remote,
    authorized master server to cause a high CPU load or even prevent any further
    updates to any slave zone by sending a large number of NOTIFY messages. Note
    that only servers configured as slaves are affected by this issue
    (CVE-2019-10163).
    
    An issue has been found in PowerDNS Authoritative Server allowing an
    authorized user to cause the server to exit by inserting a crafted record in a
    MASTER type zone under their control. The issue is due to the fact that the
    Authoritative Server will exit when it tries to store the notified serial in
    the PostgreSQL database, if this serial cannot be represented in 31 bits
    (CVE-2019-10203).
    
    An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an
    authorized user with the ability to insert crafted records into a zone might be
    able to leak the content of uninitialized memory. Such a user could be a
    customer inserting data via a control panel, or somebody with access to the
    REST API. Crafted records cannot be inserted via AXFR (CVE-2020-17482).
    
    The pdns package has been updated to version 4.1.14, fixing these issues and
    several other bugs.  See the upstream changelog for details.
    
    Also note that manual intervention is required to fix the CVE-2019-10203 issue
    for those using PostgreSQL with pdns.  See the upstream blog post for details.
    
    References:
    - https://bugs.mageia.org/show_bug.cgi?id=24994
    - https://bugs.mageia.org/show_bug.cgi?id=27310
    - https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.14
    - https://blog.powerdns.com/2019/08/01/security-notice-for-powerdnspostgres-users/
    - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-04.html
    - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-05.html
    - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-06.html
    - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10162
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10163
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10203
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17482
    
    SRPMS:
    - 7/core/pdns-4.1.14-1.mga7
    

    LinuxSecurity Poll

    Tails is the most secure Linux distro out there.

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).
    /main-polls/41-ubuntu-is-a-more-secure-distro-than-fedora?task=poll.vote&format=json
    41
    radio
    [{"id":"142","title":"Yes - Tails get my vote!","votes":"1","type":"x","order":"1","pct":100,"resources":[]},{"id":"143","title":"Nope - Parrot OS has surpassed Tails in its security and privacy.","votes":"0","type":"x","order":"2","pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.