PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7203-1 advisory.

    Wei Hao discovered that PowerDNS Authoritative Server incorrectly handled memory when accessing certain     files. An attacker could possibly use this issue to achieve arbitrary code execution. (CVE-2018-1046)

    It was discovered that PowerDNS Authoritative Server and PowerDNS Recursor incorrectly handled memory when     receiving certain remote input. An attacker could possibly use this issue to cause denial of service.
    (CVE-2018-10851)

    Kees Monshouwer discovered that PowerDNS Authoritative Server and PowerDNS Recursor incorrectly handled     request validation after having cached malformed input. An attacker could possibly use this issue to cause     denial of service. (CVE-2018-14626)

    Toshifumi Sakaguchi discovered that PowerDNS Recursor incorrectly handled requests after having cached     malformed input. An attacker could possibly use this issue to cause denial of service. (CVE-2018-14644)

    Nathaniel Ferguson discovered that PowerDNS Authoritative Server incorrectly handled memory when receiving     certain remote input. An attacker could possibly use this issue to obtain sensitive information.
    (CVE-2020-17482)

    Nicolas Dehaine and Dmitry Shabanov discovered that PowerDNS Authoritative Server and PowerDNS Recursor     incorrectly handled IXFR requests in certain circumstances. An attacker could possibly use this issue to     cause denial of service. (CVE-2022-27227)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for pdns fixes the following issues :

Security issues fixed :

  - CVE-2018-10851: Fixed denial of service via crafted zone     record or crafted answer (bsc#1114157).

  - CVE-2018-14626: Fixed packet cache pollution via crafted     query (bsc#1114169).

This update for pdns-recursor fixes the following issues :

Security issues fixed :

  - CVE-2018-10851: Fixed denial of service via crafted zone     record or crafted answer (bsc#1114157).

  - CVE-2018-14644: Fixed denial of service via crafted     query for meta-types (bsc#1114170).

  - CVE-2018-14626: Fixed packet cache pollution via crafted     query (bsc#1114169).

  - CVE-2018-16855: Fixed case where a crafted query could     cause a denial of service (bsc#1116592)

Fixes CVE-2018-16855 (Crafted query can cause a denial of service)

----

New upstream release with security fixes for CVE-2018-10851, CVE-2018-14626 and CVE-2018-14644

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 4.1.5

Release notes:
https://blog.powerdns.com/2018/11/06/powerdns-authoritative-server-4-0
-6-4-1-5-and-recursor-4-0-9-4-1-5-released/

PowerDNS Security Advisory 2018-03 (https://doc.powerdns.com/authoritative/security-advisories/powerdns-a dvisory-2018-03.html) (CVE-2018-10851)

PowerDNS Security Advisory 2018-05 (https://doc.powerdns.com/authoritative/security-advisories/powerdns-a dvisory-2018-05.html) (CVE-2018-14626)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pdns fixes the following issues :

Security issues fixed :

  - CVE-2018-10851: Fixed denial of service via crafted zone     record or crafted answer (bsc#1114157).

This update for pdns-recursor fixes the following issues :

Security issues fixed :

  - CVE-2018-10851: Fixed denial of service via crafted zone     record or crafted answer (bsc#1114157).

  - CVE-2018-14644: Fixed denial of service via crafted     query for meta-types (bsc#1114170).

  - CVE-2018-14626: Fixed packet cache pollution via crafted     query (bsc#1114169).

PowerDNS Team reports :

CVE-2018-10851: An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause a memory leak by inserting a specially crafted record in a zone under their control, then sending a DNS query for that record. The issue is due to the fact that some memory is allocated before the parsing and is not always properly released if the record is malformed. When the PowerDNS Authoritative Server is run inside the guardian (--guardian), or inside a supervisor like supervisord or systemd, an out-of-memory crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.

CVE-2018-14626: An issue has been found in PowerDNS Authoritative Server allowing a remote user to craft a DNS query that will cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients will consider the answer to be bogus until it expires from the packet cache, leading to a denial of service.

powerdns Team reports :

CVE-2018-10851: An issue has been found in PowerDNS Recursor allowing a malicious authoritative server to cause a memory leak by sending specially crafted records. The issue is due to the fact that some memory is allocated before the parsing and is not always properly released if the record is malformed. When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, an out-of-memory crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.

CVE-2018-14626: An issue has been found in PowerDNS Recursor allowing a remote user to craft a DNS query that will cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype. For a DNSSEC-signed domain, this means that clients performing DNSSEC validation by themselves might consider the answer to be bogus until it expires from the packet cache, leading to a denial of service.

CVE-2018-14644: An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached as failing DNSSEC validation. It only arises if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for at least one of the meta-types. As a result, subsequent queries from clients requesting DNSSEC validation will be answered with a ServFail.

ID	Name	Product	Family	Severity
214098	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : PowerDNS vulnerabilities (USN-7203-1)	Nessus	Ubuntu Local Security Checks	high
123406	openSUSE Security Update : pdns (openSUSE-2019-989)	Nessus	SuSE Local Security Checks	high
123405	openSUSE Security Update : pdns-recursor (openSUSE-2019-988)	Nessus	SuSE Local Security Checks	high
120858	Fedora 29 : pdns-recursor (2018-e14840a7f5)	Nessus	Fedora Local Security Checks	high
120764	Fedora 28 : pdns-recursor (2018-c341b70641)	Nessus	Fedora Local Security Checks	high
120583	Fedora 29 : pdns (2018-85fc964de8)	Nessus	Fedora Local Security Checks	high
120329	Fedora 28 : pdns (2018-2ff7cdbb7b)	Nessus	Fedora Local Security Checks	high
119862	openSUSE Security Update : pdns (openSUSE-2018-1594)	Nessus	SuSE Local Security Checks	high
119739	openSUSE Security Update : pdns (openSUSE-2018-1566)	Nessus	SuSE Local Security Checks	high
119738	openSUSE Security Update : pdns-recursor (openSUSE-2018-1565)	Nessus	SuSE Local Security Checks	high
119737	openSUSE Security Update : pdns-recursor (openSUSE-2018-1564)	Nessus	SuSE Local Security Checks	high
119056	FreeBSD : powerdns -- Multiple vulnerabilities (0aee2f13-ec1d-11e8-8c92-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	high
119021	FreeBSD : powerdns-recursor -- Multiple vulnerabilities (e9aa0e4c-ea8b-11e8-a5b7-00e04c1ea73d)	Nessus	FreeBSD Local Security Checks	high
119007	Fedora 27 : pdns (2018-5a1e2759aa)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-10851

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high