An information disclosure vulnerability in PowerDNS allow remote attackers to obtain sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/pdns | * | < 4.3.1 | >= 4.3.1 |
The PowerDNS nameserver is an authoritative-only nameserver which uses a flexible backend architecture.
It was discovered that PowerDNS did not properly handle certain unknown records.
An authorized attacker with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory. Crafted records cannot be inserted via AXFR.
Do not take zone data from untrusted users.
All PowerDNS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/pdns-4.3.1"
A vulnerability in PowerDNS could allow a remote attacker to create a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/pdns | * | < 3.0.1 | >= 3.0.1 |
The PowerDNS nameserver is an authoritative-only nameserver which uses a flexible backend architecture.
A vulnerability has been found in PowerDNS which could cause a packet loop of DNS responses.
A remote attacker could send specially crafted DNS response packets, possibly resulting in a Denial of Service condition.
PowerDNS users can set "cache-ttl=0" in /etc/powerdns/pdns.conf and then restart the PowerDNS daemon:
# /etc/init.d/pdns restart
Please review the PowerDNS Security Advisory below for more workaround details.
All PowerDNS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/pdns-3.0.1"
Two vulnerabilities have been discovered in PowerDNS, possibly leading to a Denial of Service and easing cache poisoning attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/pdns | * | < 2.9.21.2 | >= 2.9.21.2 |
The PowerDNS Nameserver is an authoritative-only nameserver which uses a flexible backend architecture.
Daniel Drown reported an error when receiving a HINFO CH query (CVE-2008-5277). Brian J. Dowling of Simplicity Communications discovered a previously unknown security implication of the PowerDNS behavior to not respond to certain queries it considers malformed (CVE-2008-3337).
A remote attacker could send specially crafted queries to cause a Denial of Service. The second vulnerability in itself does not pose a security risk to PowerDNS Nameserver. However, not answering a query for an invalid DNS record within a valid domain allows for a larger spoofing window on third-party nameservers for domains being hosted by PowerDNS Nameserver itself.
There is no known workaround at this time.
All PowerDNS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/pdns-2.9.21.2"
A vulnerability in PowerDNS could lead to a temporary Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/pdns | * | < 2.9.17 | >= 2.9.17 |
The PowerDNS Nameserver is an authoritative-only nameserver which uses a flexible backend architecture.
A vulnerability has been reported in the DNSPacket::expand method of dnspacket.cc.
An attacker could cause a temporary Denial of Service by sending a random stream of bytes to the PowerDNS Daemon.
There is no known workaround at this time.
All PowerDNS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/pdns-2.9.17"