An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate), and for clients requesting validation when on-demand validation is enabled (dnssec=process).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A     remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation     state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of     service for installation that always validate (dnssec=validate), and for clients requesting validation     when on-demand validation is enabled (dnssec=process). (CVE-2020-25829)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3855 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3855-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     July 01, 2024                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : pdns-recursor     Version        : 4.1.11-1+deb10u2     CVE ID         : CVE-2020-14196 CVE-2020-25829     Debian Bug     : 964103 972159

    Brief introduction

    CVE-2020-14196

        The ACL restricting access to the internal web server is not properly         enforced.

    CVE-2020-25829

        A remote attacker can cause the cached records for a given name to be         updated to the Bogus DNSSEC validation state, instead of their actual         DNSSEC Secure state, via a DNS ANY query. This results in a denial of         service for installation that always validate (dnssec=validate), and         for clients requesting validation when on-demand validation is enabled.

    For Debian 10 buster, these problems have been fixed in version     4.1.11-1+deb10u2.

    We recommend that you upgrade your pdns-recursor packages.

    For the detailed security status of pdns-recursor please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/pdns-recursor

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202012-19 (PowerDNS Recursor: Denial of service)

    It was discovered that it was possible to update the DNSSEC validation       state to a bogus state for a cached record via DNS ANY query.
  Impact :

    A remote attacker could send specially crafted DNS queries to deny       DNSSEC validation.
  Workaround :

    There is no known workaround at this time.

PowerDNS Team reports :

CVE-2020-25829: An issue has been found in PowerDNS Recursor where a remote attacker can cause the cached records for a given name to be updated to the 'Bogus' DNSSEC validation state, instead of their actual DNSSEC 'Secure' state, via a DNS ANY query. This results in a denial of service for installations that always validate (dnssec=validate) and for clients requesting validation when on-demand validation is enabled (dnssec=process).

This update for pdns-recursor fixes the following issues :

-pdns-recursorwas updated to 4.1.1 and 4.3.5 :

  - CVE-2020-25829: Fixed a cache pollution related to     DNSSEC validation (boo#1177383)

  - CVE-2020-14196: Fixed an access restriction bypass with     API key and password authentication (boo#1173302).

ID	Name	Product	Family	Severity
246957	Linux Distros Unpatched Vulnerability : CVE-2020-25829	Nessus	Misc.	high
201171	Debian dla-3855 : pdns-recursor - security update	Nessus	Debian Local Security Checks	medium
144600	GLSA-202012-19 : PowerDNS Recursor: Denial of service	Nessus	Gentoo Local Security Checks	high
141549	FreeBSD : powerdns-recursor -- cache pollution (a6860b11-0dee-11eb-94ff-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	high
141530	openSUSE Security Update : pdns-recursor (openSUSE-2020-1687)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-25829

high

Tenable Plugins

high

medium

high

high

medium