An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and     including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in     bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter     the content of records by issuing a valid signature for the crafted records. (CVE-2017-15090)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and
    including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in
    bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter
    the content of records by issuing a valid signature for the crafted records. (CVE-2017-15090)

  - A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and
    including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote
    attacker to inject HTML and Javascript code into the web interface, altering the content. (CVE-2017-15092)

  - When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS
    Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to
    update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was
    discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated,
    allowing an authenticated user to inject new configuration directives into the Recursor's configuration.
    (CVE-2017-15093)

  - An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including
    4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only
    parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate
    (default). (CVE-2017-15094)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and
    including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in
    bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter
    the content of records by issuing a valid signature for the crafted records. (CVE-2017-15090)

- Upstream released new version

  - Fix a bunch of CVE's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 4.0.x prior to 4.0.7. It is, therefore, affected by multiple vulnerabilities:

  - Insufficient validation of DNSSEC signatures.
    (CVE-2017-15090)

  - Cross-Site Scripting (XSS) in the web interface.
    (CVE-2017-15092)

  - Memory leak in DNSSEC parsing. (CVE-2017-15094)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

Update to latest version. Contains security fixes for CVE-2017-15090, CVE-2017-15092, CVE-2017-15093 and CVE-2017-15094

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pdns-recursor fixes the following issues :

Security issues fixed :

  - CVE-2017-15090: An issue has been found in the DNSSEC     validation component of PowerDNS Recursor, where the     signatures might have been accepted as valid even if the     signed data was not in bailiwick of the DNSKEY used to     sign it. This allows an attacker in position of     man-in-the-middle to alter the content of records by     issuing a valid signature for the crafted records     (boo#1069242).

  - CVE-2017-15092: An issue has been found in the web     interface of PowerDNS Recursor, where the qname of DNS     queries was displayed without any escaping, allowing a     remote attacker to inject HTML and JavaScript code into     the web interface, altering the content (boo#1069242).

  - CVE-2017-15093: When `api-config-dir` is set to a     non-empty value, which is not the case by default, the     API allows an authorized user to update the Recursor's     ACL by adding and removing netmasks, and to configure     forward zones. It was discovered that the new netmask     and IP addresses of forwarded zones were not     sufficiently validated, allowing an authenticated user     to inject new configuration directives into the     Recursor's configuration (boo#1069242).

  - CVE-2017-15094: An issue has been found in the DNSSEC     parsing code of PowerDNS Recursor during a code audit by     Nixu, leading to a memory leak when parsing specially     crafted DNSSEC ECDSA keys (boo#1069242).

ID	Name	Product	Family	Severity
245155	Linux Distros Unpatched Vulnerability : CVE-2017-15090	Nessus	Misc.	medium
406249	Alpine: multiple pdns-recursor packages: security update to 4.0.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406249	Alpine: multiple pdns-recursor packages: security update to 4.0.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400782	Alpine: multiple pdns-recursor packages: security update to 4.0.6-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400782	Alpine: multiple pdns-recursor packages: security update to 4.0.6-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
110520	Fedora 27 : pdns-recursor (2018-76c82b393e)	Nessus	Fedora Local Security Checks	medium
106193	PowerDNS Recursor 4.0.x < 4.0.7 Multiple Vulnerabilities	Nessus	DNS	medium
105888	Fedora 27 : pdns-recursor (2017-608b6f5945)	Nessus	Fedora Local Security Checks	medium
105229	openSUSE Security Update : pdns-recursor (openSUSE-2017-1339)	Nessus	SuSE Local Security Checks	medium
105203	Fedora 25 : pdns-recursor (2017-81fe39ad9f)	Nessus	Fedora Local Security Checks	medium
105198	Fedora 26 : pdns-recursor (2017-1585789772)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-15090

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium