- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200812-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PowerDNS: Multiple vulnerabilities Date: December 19, 2008 Bugs: #234032, #247079 ID: 200812-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Two vulnerabilities have been discovered in PowerDNS, possibly leading to a Denial of Service and easing cache poisoning attacks. Background ========== The PowerDNS Nameserver is an authoritative-only nameserver which uses a flexible backend architecture. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-dns/pdns < 2.9.21.2 >= 2.9.21.2 Description =========== Daniel Drown reported an error when receiving a HINFO CH query (CVE-2008-5277). Brian J. Dowling of Simplicity Communications discovered a previously unknown security implication of the PowerDNS behavior to not respond to certain queries it considers malformed (CVE-2008-3337). Impact ====== A remote attacker could send specially crafted queries to cause a Denial of Service. The second vulnerability in itself does not pose a security risk to PowerDNS Nameserver. However, not answering a query for an invalid DNS record within a valid domain allows for a larger spoofing window on third-party nameservers for domains being hosted by PowerDNS Nameserver itself. Workaround ========== There is no known workaround at this time. Resolution ========== All PowerDNS users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/pdns-2.9.21.2" References ========== [ 1 ] CVE-2008-3337 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3337 [ 2 ] CVE-2008-5277 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5277 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200812-19.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@xxxxxxxxxx or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2008 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
Attachment:
signature.asc
Description: OpenPGP digital signature