Arch Linux Security Advisory ASA-202005-10 ========================================== Severity: Medium Date : 2020-05-19 CVE-ID : CVE-2020-10995 CVE-2020-12244 Package : powerdns-recursor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1163 Summary ======= The package powerdns-recursor before version 4.2.2-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 4.2.2-1. # pacman -Syu "powerdns-recursor>=4.2.2-1" The problems have been fixed upstream in version 4.2.2. Workaround ========== None. Description =========== - CVE-2020-10995 (denial of service) An issue has been found in PowerDNS Recursor before 4.3.1 and 4.2.2. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. The effect was already limited in PowerDNS Recursor because of existing mitigations, but additional mitigations relative to this specific attack have been added. - CVE-2020-12244 (insufficient validation) An issue has been found in PowerDNS Recursor before 4.3.1 and 4.2.2 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer. This would allow an attacker in position of man-in-the-middle to send a NXDOMAIN answer for a name that does exist, bypassing DNSSEC validation. Impact ====== A remote attacker can use the recursor has an amplification vector to cause a denial of service via a crafted reply. In addition, a remote attacker in position of man-in-the-middle can bypass DNSSEC validation via a crafted reply. References ========== https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-202... https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-202... https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-202... https://github.com/PowerDNS/pdns/commit/86f95f85295696c0b264455472b8e270fccb... http://www.nxnsattack.com/ https://github.com/PowerDNS/pdns/commit/4bba0ec04aacbec08fe585ad790e2e8e0cb7... https://security.archlinux.org/CVE-2020-10995 https://security.archlinux.org/CVE-2020-12244