An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the api-readonly keyword. This missing check allows an attacker with valid API credentials to flush the cache, trigger a zone transfer or send a NOTIFY.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and     3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are     still allowed even though the API has been configured as read-only via the api-readonly keyword. This     missing check allows an attacker with valid API credentials to flush the cache, trigger a zone transfer or     send a NOTIFY. (CVE-2017-15091)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and
    3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are
    still allowed even though the API has been configured as read-only via the api-readonly keyword. This
    missing check allows an attacker with valid API credentials to flush the cache, trigger a zone transfer or
    send a NOTIFY. (CVE-2017-15091)

According to its self-reported version number, the version of the PowerDNS Authoritative listening on the remote host is prior to 4.0.5. It is, therefore, affected by a vulnerability in the API where a remote authenticated attacker can perform operations that affect the server state even if the api-readonly configuration is enabled.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

This update for pdns fixes the following issues :

Security issue fixed :

  - CVE-2017-15091: An issue has been found in the API     component of PowerDNS Authoritative, where some     operations that have an impact on the state of the     server are still allowed even though the API has been     configured as read-only. This missing check allows an     attacker with valid API credentials could flush the     cache, trigger a zone transfer or send a NOTIFY     (boo#1069242).

ID	Name	Product	Family	Severity
254600	Linux Distros Unpatched Vulnerability : CVE-2017-15091	Nessus	Misc.	high
406234	Alpine: multiple pdns packages: security update to 4.0.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406234	Alpine: multiple pdns packages: security update to 4.0.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400749	Alpine: multiple pdns packages: security update to 4.0.4-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400749	Alpine: multiple pdns packages: security update to 4.0.4-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
106192	PowerDNS Authoritative < 4.0.5 Read Only Configuration Bypass (CVE-2017-15091)	Nessus	DNS	high
105230	openSUSE Security Update : pdns (openSUSE-2017-1340)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-15091

high

Tenable Plugins

high

high

high

high

high

high

high