PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial     of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.
    (CVE-2016-6172)

Note that Nessus relies on the presence of the package as reported by the vendor.

Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2016-5426 / CVE-2016-5427

Florian Heinz and Martin Kluge reported that the PowerDNS Authoritative Server accepts queries with a qname's length larger than 255 bytes and does not properly handle dot inside labels. A remote, unauthenticated attacker can take advantage of these flaws to cause abnormal load on the PowerDNS backend by sending specially crafted DNS queries, potentially leading to a denial of service.

CVE-2016-6172

It was reported that a malicious primary DNS server can crash a secondary PowerDNS server due to improper restriction of zone size limits. This update adds a feature to limit AXFR sizes in response to this flaw.

For Debian 7 'Wheezy', these problems have been fixed in version 3.1-4.1+deb7u2.

We recommend that you upgrade your pdns packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-5426 / CVE-2016-5427     Florian Heinz and Martin Kluge reported that the     PowerDNS Authoritative Server accepts queries with a     qname's length larger than 255 bytes and does not     properly handle dot inside labels. A remote,     unauthenticated attacker can take advantage of these     flaws to cause abnormal load on the PowerDNS backend by     sending specially crafted DNS queries, potentially     leading to a denial of service.

  - CVE-2016-6172     It was reported that a malicious primary DNS server can     crash a secondary PowerDNS server due to improper     restriction of zone size limits. This update adds a     feature to limit AXFR sizes in response to this flaw.

This update for pdns fixes the following issues :

  - CVE-2016-6172: malicious primary DNS servers can crash     secondaries through large transfers (boo#987872)

As mitigation, the xfr-max-received-mbytes config option was added, defaulting to to 100 (MB).

ISC reports :

DNS protocols were designed with the assumption that a certain amount of trust could be presumed between the operators of primary and secondary servers for a given zone. However, in current practice some organizations have scenarios which require them to accept zone data from sources that are not fully trusted (for example: providers of secondary name service). A party who is allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS updates) can overwhelm the server which is accepting data by intentionally or accidentally exhausting that server's memory.

- Update to 4.0.1

Release notes:
https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-4 01

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254833	Linux Distros Unpatched Vulnerability : CVE-2016-6172	Nessus	Misc.	medium
93567	Debian DLA-627-1 : pdns security update	Nessus	Debian Local Security Checks	high
93419	Debian DSA-3664-1 : pdns - security update	Nessus	Debian Local Security Checks	high
93064	openSUSE Security Update : pdns (openSUSE-2016-1004)	Nessus	SuSE Local Security Checks	medium
92832	FreeBSD : BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers (7d08e608-5e95-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
92803	Fedora 24 : pdns (2016-7098bdc536)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-6172

medium

Tenable Plugins

medium

high

high

medium

high

medium