PowerDNS before 2.9.18, when allowing recursion to a restricted range of IP addresses, does not properly handle questions from clients that are denied recursion, which could cause a "blank out" of answers to those clients that are allowed to use recursion.

According to its self-reported version number, the version of the PowerDNS service listening on the remote host is prior to 2.9.18. It is, therefore, affected by multiple vulnerabilities : 

  - A flaw exists due to improper escaping of LDAP queries.
  	A remote attacker can exploit this to cause a denial of   	service condition or to conduct LDAP injection attacks.
  	(CVE-2005-2301)

  - A denial of service vulnerability exists when allowing   	recursion to a restricted range of IP addresses due to   	improper handling of questions from clients that are   	denied a recursion. An attacker can exploit this to   	prevent answers to those clients that are allowed to use   	recursion. (CVE-2005-2302)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

This advisory adds security support for the stable amd64 distribution.
It covers all security updates since the release of sarge, which were missing updated packages for the not yet official amd64 port. Future security advisories will include updates for this port as well.

The LDAP backend in PowerDNS has issues with escaping queries which could cause connection errors. This would make it possible for a malicious user to temporarily blank domains.

This is known to affect all releases prior to 2.9.18.

Several problems have been discovered in pdns, a versatile nameserver that can lead to a denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-2301     Norbert Sendetzky and Jan de Groot discovered that the     LDAP backend did not properly escape all queries,     allowing it to fail and not answer queries anymore.

  - CAN-2005-2302

    Wilco Baan discovered that queries from clients without     recursion permission can temporarily blank out domains     to clients with recursion permitted. This enables     outside users to blank out a domain temporarily to     normal users.

ID	Name	Product	Family	Severity
87945	PowerDNS < 2.9.18 Multiple Vulnerabilities	Nessus	DNS	medium
57528	Debian DSA-773-1 : amd64 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
19341	FreeBSD : PowerDNS -- LDAP backend fails to escape all queries (43a7b0a7-f9bc-11d9-b473-00061bc2ad93)	Nessus	FreeBSD Local Security Checks	low
19336	Debian DSA-771-1 : pdns - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2005-2302

high

Tenable Plugins

medium

critical

low

medium