Security Update for pdns
Summary
DLA-627-1: pdns - security update. Affects pdns versions < 3.1-4.1+deb7u2. Fixed in 3.1-4.1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pdns is an authoritative DNS server that is used to handle DNS queries and provide DNS resolution services. It is a critical component of the DNS infrastructure and is responsible for translating domain names into IP addresses. This vulnerability affects pdns version 3.1-4.1+deb7u2 on Debian 7 Wheezy.
Vulnerability Detail
Multiple vulnerabilities have been discovered in pdns. The first vulnerability, identified as CVE-2016-5426 and CVE-2016-5427, allows remote, unauthenticated attackers to cause abnormal load on the PowerDNS backend by sending specially crafted DNS queries with a qname's length larger than 255 bytes and dot inside labels. This can potentially lead to a denial of service. The second vulnerability, identified as CVE-2016-6172, allows a malicious primary DNS server to crash a secondary PowerDNS server due to improper restriction of zone size limits. This update adds a feature to limit AXFR sizes in response to this flaw.
How To Fix
Minimum fixed version
3.1-4.1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pdnsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
It is crucial to upgrade your pdns packages to version 3.1-4.1+deb7u2 or later to mitigate these vulnerabilities. Failure to do so may result in a denial of service or crashes of secondary PowerDNS servers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pdns →
FAQ
These vulnerabilities can allow remote attackers to cause abnormal load on the PowerDNS backend and potentially lead to a denial of service. Additionally, a malicious primary DNS server can crash a secondary PowerDNS server.
Users of pdns version 3.1-4.1+deb7u2 on Debian 7 Wheezy are affected by these vulnerabilities.
There are no known exploits for these vulnerabilities at the time of this advisory.
Yes, a patch is available in pdns version 3.1-4.1+deb7u2.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and the Vulert Playground will analyze it for vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for pdns.
