common_startup.cc in PowerDNS (aka pdns) Authoritative Server before 2.9.22.5 and 3.x before 3.0.1 allows remote attackers to cause a denial of service (packet loop) via a crafted UDP DNS response.

This update of PowerDNS fixes a Denial of Service flaw which could be exploited by remote attackers via specially crafted DNS queries (CVE-2012-0206).

specially crafted request could lead to denial of service

The remote host is affected by the vulnerability described in GLSA-201202-04 (PowerDNS: Denial of Service)

    A vulnerability has been found in PowerDNS which could cause a packet       loop of DNS responses.
  Impact :

    A remote attacker could send specially crafted DNS response packets,       possibly resulting in a Denial of Service condition.
  Workaround :

    PowerDNS users can set 'cache-ttl=0' in /etc/powerdns/pdns.conf and then       restart the PowerDNS daemon:
      # /etc/init.d/pdns restart     Please review the PowerDNS Security Advisory below for more workaround       details.

Upstream released new version. Fixes crash introduced in 2.9.22.5 CVE-2012-0206

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes :

  - Bug #772581 - PowerDNS DoS Vulnerability

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the version of the PowerDNS service listening on the remote host is prior to 2.9.22.5 or 3.0.1. It is, therefore, affected by a denial of service vulnerability due to improper handling of response packets. A remote attacker can exploit this, via a specially crafted packet, to tagger an infinite packet response loop, resulting in a denial of service condition.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of any of the workarounds or if a patch is applied. Furthermore, for versions prior to 3.x, Nessus did not check if the server is operating as an authoritative server.

The PowerDNS Team reports :

Using well crafted UDP packets, one or more PowerDNS servers could be made to enter a tight packet loop, causing temporary denial of service.

Ray Morris discovered that the PowerDNS authoritative server responds to response packets. An attacker who can spoof the source address of IP packets can cause an endless packet loop between a PowerDNS authoritative server and another DNS server, leading to a denial of service.

ID	Name	Product	Family	Severity
75992	openSUSE Security Update : pdns (openSUSE-SU-2012:0200-1)	Nessus	SuSE Local Security Checks	medium
74847	openSUSE Security Update : pdns (openSUSE-2012-85)	Nessus	SuSE Local Security Checks	medium
58100	GLSA-201202-04 : PowerDNS: Denial of Service	Nessus	Gentoo Local Security Checks	medium
57901	Fedora 15 : pdns-2.9.22.6-1.fc15 (2012-1207)	Nessus	Fedora Local Security Checks	medium
57590	Fedora 16 : pdns-3.0.1-1.fc16 (2012-0263)	Nessus	Fedora Local Security Checks	medium
57573	PowerDNS Authoritative Server < 2.9.22.5 / 3.0.1 Response Packet Parsing DoS	Nessus	DNS	medium
57529	FreeBSD : PowerDNS -- Denial of Service Vulnerability (3338f87c-3d5f-11e1-a00a-000c6eb41cf7)	Nessus	FreeBSD Local Security Checks	medium
57525	Debian DSA-2385-1 : pdns - packet loop	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-0206

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium