A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an     authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under     their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a     parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.
    (CVE-2019-10162)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an
    authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under
    their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a
    parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.
    (CVE-2019-10162)

  - A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a
    remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave
    zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are
    affected by this issue. (CVE-2019-10163)

This update for pdns fixes the following issues :

Security issues fixed :

  - CVE-2019-10203: Updated PostgreSQL schema to address a     possible denial of service by an authorized user by     inserting a crafted record in a MASTER type zone under     their control. (boo#1142810)

  - CVE-2019-10162: Fixed a denial of service but when     authorized user to cause the server to exit by inserting     a crafted record in a MASTER type zone under their     control. (boo#1138582)

  - CVE-2019-10163: Fixed a denial of service of slave     server when an authorized master server sends large     number of NOTIFY messages. (boo#1138582) &#9;
    Non-security issues fixed :

  - Enabled the option to disable superslave support.

  - Fixed `pdnsutil b2b-migrate` to not lose NSEC3 settings.

Two vulnerabilities have been discovered in pdns, an authoritative DNS server which may result in denial of service via malformed zone records and excessive NOTIFY packets in a master/slave setup.

CVE-2019-10162

An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.

CVE-2019-10163

An issue has been found in PowerDNS Authoritative Server allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.

For Debian 8 'Jessie', these problems have been fixed in version 3.4.1-4+deb8u10.

We recommend that you upgrade your pdns packages.

For the detailed security status of pdns please refer to its security tracker page at: https://security-tracker.debian.org/tracker/pdns

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PowerDNS Team reports :

CVE-2019-10162: An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control.
The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.

CVE-2019-10163: An issue has been found in PowerDNS Authoritative Server allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.

Two vulnerabilities have been discovered in pdns, an authoritative DNS server which may result in denial of service via malformed zone records and excessive NOTIFY packets in a master/slave setup.

ID	Name	Product	Family	Severity
257624	Linux Distros Unpatched Vulnerability : CVE-2019-10162	Nessus	Misc.	high
406238	Alpine: multiple pdns packages: security update to 4.1.10-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406238	Alpine: multiple pdns packages: security update to 4.1.10-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
406237	Alpine: multiple pdns packages: security update to 4.0.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406237	Alpine: multiple pdns packages: security update to 4.0.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400566	Alpine: multiple pdns packages: security update to 4.1.8-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400566	Alpine: multiple pdns packages: security update to 4.1.8-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
127996	openSUSE Security Update : pdns (openSUSE-2019-1904)	Nessus	SuSE Local Security Checks	high
126481	Debian DLA-1843-1 : pdns security update	Nessus	Debian Local Security Checks	high
126363	FreeBSD : powerdns -- multiple vulnerabilities (1c21f6a3-9415-11e9-95ec-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	high
126129	Debian DSA-4470-1 : pdns - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-10162

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high