The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.

The remote host is affected by the vulnerability described in GLSA-201412-33 (PowerDNS Recursor: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PowerDNS Recursor.
      Please review the CVE identifiers and PowerDNS blog post referenced below       for details.
  Impact :

    A remote attacker may be able to send specially crafted packets,       possibly resulting in arbitrary code execution or a Denial of Service       condition. Furthermore, a remote attacker may be able to spoof DNS data.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the version of the PowerDNS Recursor service listening on the remote host is 3.3.x, 3.4.x, or 3.5 RC1. It is, therefore, affected by a ghost domain names vulnerability in the resolver service due to overwriting cached name servers and TTL values in NS records when processing a response of an A record query. A remote attacker can exploit this to resume the resolving of revoked domain names.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

- Update to 3.5

    - This is a stability, security and bugfix update to 3.3

    - Disarm dead code that causes gcc crashes on ARM       (rhbz#954192)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 3.5

    - This is a stability, security and bugfix update to 3.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80210	GLSA-201412-33 : PowerDNS Recursor: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
69429	PowerDNS Recursor 3.3.x / 3.4.x / 3.5 RC1 Cache Update Policy Deleted Domain Name Resolving Weakness	Nessus	DNS	medium
66283	Fedora 17 : pdns-recursor-3.5-2.fc17 (2013-6316)	Nessus	Fedora Local Security Checks	medium
66282	Fedora 18 : pdns-recursor-3.5-2.fc18 (2013-6279)	Nessus	Fedora Local Security Checks	medium
66166	Fedora 19 : pdns-recursor-3.5-1.fc19 (2013-5692)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-1193

medium

Tenable Plugins

critical

medium

medium

medium

medium