Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in
    man-in-the-middle position to deny existence of some data in DNS via packet replay. (CVE-2018-1000003)

- Upstream released new version

  - Fix a bunch of CVE's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 4.1.0. It is, therefore, affected by a flaw when handling DNSSEC signature validation of NSEC or NSEC3 records.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

PowerDNS Security Advisory reports :

An issue has been found in the DNSSEC validation component of PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3 record to be used to wrongfully prove the non-existence of a RR below the owner name of that record. This would allow an attacker in position of man-in-the-middle to send a NXDOMAIN answer for a name that does exist.

ID	Name	Product	Family	Severity
406251	Alpine: multiple pdns-recursor packages: security update to 4.1.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	low
406251	Alpine: multiple pdns-recursor packages: security update to 4.1.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	low
110520	Fedora 27 : pdns-recursor (2018-76c82b393e)	Nessus	Fedora Local Security Checks	medium
106487	PowerDNS Recursor 4.1.0 DNSSEC Signature Validation Spoofing Vulnerability (CVE-2018-1000003)	Nessus	DNS	low
106287	FreeBSD : powerdns-recursor -- insufficient validation of DNSSEC signatures (24a82876-002e-11e8-9a95-0cc47a02c232)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2018-1000003

low

Tenable Plugins

low

low

medium

low

low