[ASA-202005-10] powerdns-recursor: multiple issues

[Morten Linderud]

Arch Linux Security Advisory ASA-202005-10
==========================================

Severity: Medium
Date    : 2020-05-19
CVE-ID  : CVE-2020-10995 CVE-2020-12244
Package : powerdns-recursor
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1163

Summary
=======

The package powerdns-recursor before version 4.2.2-1 is vulnerable to
multiple issues including denial of service and insufficient
validation.

Resolution
==========

Upgrade to 4.2.2-1.

# pacman -Syu "powerdns-recursor>=4.2.2-1"

The problems have been fixed upstream in version 4.2.2.

Workaround
==========

None.

Description
===========

- CVE-2020-10995 (denial of service)

An issue has been found in PowerDNS Recursor before 4.3.1 and 4.2.2. An
issue in the DNS protocol has been found that allow malicious parties
to use recursive DNS services to attack third party authoritative name
servers. The attack uses a crafted reply by an authoritative name
server to amplify the resulting traffic between the recursive and other
authoritative name servers. Both types of service can suffer degraded
performance as an effect. The effect was already limited in PowerDNS
Recursor because of existing mitigations, but additional mitigations
relative to this specific attack have been added.

- CVE-2020-12244 (insufficient validation)

An issue has been found in PowerDNS Recursor before 4.3.1 and 4.2.2
where records in the answer section of a NXDOMAIN response lacking an
SOA were not properly validated in SyncRes::processAnswer. This would
allow an attacker in position of man-in-the-middle to send a NXDOMAIN
answer for a name that does exist, bypassing DNSSEC validation.

Impact
======

A remote attacker can use the recursor has an amplification vector to
cause a denial of service via a crafted reply. In addition, a remote
attacker in position of man-in-the-middle can bypass DNSSEC validation
via a crafted reply.

References
==========

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-01.html
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-02.html
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-03.html
https://github.com/PowerDNS/pdns/commit/86f95f85295696c0b264455472b8e270fccb6542
http://www.nxnsattack.com/
https://github.com/PowerDNS/pdns/commit/4bba0ec04aacbec08fe585ad790e2e8e0cb7b04a
https://security.archlinux.org/CVE-2020-10995
https://security.archlinux.org/CVE-2020-12244
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20200523/bd76eb1a/attachment.sig>