PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make it easier for remote attackers to poison DNS caches of other products running on other servers, a different issue than CVE-2008-1447 and CVE-2008-3217.

This update of pdns offers better spoofing resistance by not ignoring invalid queries. (CVE-2008-3337)

The remote host is affected by the vulnerability described in GLSA-200812-19 (PowerDNS: Multiple vulnerabilities)

    Daniel Drown reported an error when receiving a HINFO CH query     (CVE-2008-5277). Brian J. Dowling of Simplicity Communications     discovered a previously unknown security implication of the PowerDNS     behavior to not respond to certain queries it considers malformed     (CVE-2008-3337).
  Impact :

    A remote attacker could send specially crafted queries to cause a     Denial of Service. The second vulnerability in itself does not pose a     security risk to PowerDNS Nameserver. However, not answering a query     for an invalid DNS record within a valid domain allows for a larger     spoofing window on third-party nameservers for domains being hosted by     PowerDNS Nameserver itself.
  Workaround :

    There is no known workaround at this time.

Brian Dowling discovered that the PowerDNS authoritative name server does not respond to DNS queries which contain certain characters, increasing the risk of successful DNS spoofing (CVE-2008-3337 ). This update changes PowerDNS to respond with SERVFAIL responses instead.

The remote DNS drops malformed queries.  If it is not just a resolver and serves a domain name, this may help poisoning the cache of other DNS resolvers.  PoweDNS 2.9.21 and earlier are known to exhibit this behavior. 

Note that this does not mean that this server would be vulnerable to cache poisoning if it were a resolver.

- Wed Aug 6 2008 Ruben Kerkhof <ruben at rubenkerkhof.com>     2.9.21.1-1

    - CVE-2008-3337

    - Sat Feb 9 2008 Ruben Kerkhof <ruben at       rubenkerkhof.com> 2.9.21-4

    - GCC 4.3 fixes

    - Wed Dec 5 2007 Ruben Kerkhof <ruben at       rubenkerkhof.com> 2.9.21-3

    - Rebuild to pick up new openldap

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Aug 6 2008 Ruben Kerkhof <ruben at rubenkerkhof.com>     2.9.21.1-1

    - CVE-2008-3337

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
40102	openSUSE Security Update : pdns (pdns-146)	Nessus	SuSE Local Security Checks	medium
35244	GLSA-200812-19 : PowerDNS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
33933	Debian DSA-1628-1 : pdns - DNS response spoofing	Nessus	Debian Local Security Checks	medium
33887	openSUSE 10 Security Update : pdns (pdns-5510)	Nessus	SuSE Local Security Checks	medium
33868	PowerDNS Authoritative Server Malformed Query Cache Poisoning Weakness	Nessus	DNS	high
33846	Fedora 8 : pdns-2.9.21.1-1.fc8 (2008-7083)	Nessus	Fedora Local Security Checks	medium
33844	Fedora 9 : pdns-2.9.21.1-1.fc9 (2008-7048)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-3337

high

Tenable Plugins

medium

medium

medium

medium

high

medium

medium