An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.

- Update to 4.0.3

  - Security fix for CVE-2016-2120, CVE-2016-7068,     CVE-2016-7072, CVE-2016-7073, CVE-2016-7074

Release notes 4.0.2:
https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-4 02 Release notes 4.0.3:
https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-4 03

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2016-2120

Mathieu Lafon discovered that pdns does not properly validate records in zones. An authorized user can take advantage of this flaw to crash server by inserting a specially crafted record in a zone under their control and then sending a DNS query for that record.

CVE-2016-7068

Florian Heinz and Martin Kluge reported that pdns parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a partial denial of service if the system becomes overloaded.

CVE-2016-7072

Mongo discovered that the webserver in pdns is susceptible to a denial of service vulnerability. A remote, unauthenticated attacker to cause a denial of service by opening a large number of f TCP connections to the web server.

CVE-2016-7073 / CVE-2016-7074

Mongo discovered that pdns does not sufficiently validate TSIG signatures, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR.

For Debian 7 'Wheezy', these problems have been fixed in version 3.1-4.1+deb7u3.

We recommend that you upgrade your pdns packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-2120, CVE-2016-7068, CVE-2016-7072, CVE-2016-7073, CVE-2016-7074

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pdns-recursor fixes the following issue :

  - CVE-2016-7068: Crafted queries could have caused     abnormal CPU usage (bsc#1018326)

PowerDNS reports :

2016-02: Crafted queries can cause abnormal CPU usage

2016-03: Denial of service via the web server

2016-04: Insufficient validation of TSIG signatures

2016-05: Crafted zone record can cause a denial of service

This update for pdns fixes the following issues :

  - CVE-2016-2120: Crafted zone record could have caused a     denial of service (bsc#1018329).

  - CVE-2016-7068: Crafted queries could have caused     abnormal CPU usage (bsc#1018326).

  - CVE-2016-7072: Denial of service via the web server     (bsc#1018327).

  - CVE-2016-7073: Fixed insufficient validation of TSIG     signatures (bsc#1018328).

  - CVE-2016-7074: Fixed insufficient validation of TSIG     signatures ((bsc#1018328).

Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-2120     Mathieu Lafon discovered that pdns does not properly     validate records in zones. An authorized user can take     advantage of this flaw to crash server by inserting a     specially crafted record in a zone under their control     and then sending a DNS query for that record.

  - CVE-2016-7068     Florian Heinz and Martin Kluge reported that pdns parses     all records present in a query regardless of whether     they are needed or even legitimate, allowing a remote,     unauthenticated attacker to cause an abnormal CPU usage     load on the pdns server, resulting in a partial denial     of service if the system becomes overloaded.

  - CVE-2016-7072     Mongo discovered that the webserver in pdns is     susceptible to a denial-of-service vulnerability,     allowing a remote, unauthenticated attacker to cause a     denial of service by opening a large number of TCP     connections to the web server.

  - CVE-2016-7073 / CVE-2016-7074     Mongo discovered that pdns does not sufficiently     validate TSIG signatures, allowing an attacker in     position of man-in-the-middle to alter the content of an     AXFR.

Florian Heinz and Martin Kluge reported that pdns-recursor, a recursive DNS server, parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a partial denial of service if the system becomes overloaded.

ID	Name	Product	Family	Severity
96897	Fedora 24 : pdns (2017-bb0b9ddf27)	Nessus	Fedora Local Security Checks	high
96849	Fedora 25 : pdns (2017-cbd5501d31)	Nessus	Fedora Local Security Checks	high
96779	Debian DLA-798-1 : pdns security update	Nessus	Debian Local Security Checks	high
96739	Fedora 25 : pdns-recursor (2017-c1ae4335e5)	Nessus	Fedora Local Security Checks	high
96738	Fedora 24 : pdns-recursor (2017-8308bc2a6e)	Nessus	Fedora Local Security Checks	high
96649	openSUSE Security Update : pdns-recursor (openSUSE-2017-129)	Nessus	SuSE Local Security Checks	high
96620	FreeBSD : powerdns -- multiple vulnerabilities (e3200958-dd6c-11e6-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
96583	openSUSE Security Update : pdns (openSUSE-2017-112)	Nessus	SuSE Local Security Checks	high
96497	Debian DSA-3764-1 : pdns - security update	Nessus	Debian Local Security Checks	high
96496	Debian DSA-3763-1 : pdns-recursor - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-7068

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high