The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 3.x prior to 3.7.3. It is, therefore, affected by a denial of service vulnerability due to improper validation of user-supplied input when handling self-referential names during label decompression. An unauthenticated, remote attacker can exploit this vulnerability, via crafted query packets, to crash the server.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

According to its self-reported version number, the version of the PowerDNS Authoritative Server listening on the remote host is version 3.x prior to 3.4.5. It is, therefore, affected by a denial of service vulnerability due to improper validation of user-supplied input when handling self-referential names during label decompression. An unauthenticated, remote attacker can exploit this, via specially crafted query packets, to crash the server.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

pdns, pdns-recursor were updated to fix two security issues.

These security issues were fixed :

  - CVE-2015-1868: The label decompression functionality in     PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x     before 3.7.2 and Authoritative (Auth) Server 3.2.x,     3.3.x before 3.3.2, and 3.4.x before 3.4.4 allowed     remote attackers to cause a denial of service (CPU     consumption or crash) via a request with a name that     refers to itself (bsc#927569).

  - CVE-2015-5470: Complete fix for CVE-2015-1868     (bsc#927569).

The PowerDNS project reports :

A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to cause crashes. On all platforms, this bug can be abused to cause service-affecting CPU spikes.

- Update to 3.7.2

    - CVE-2015-1868

External References:
https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2015-1868

External References:
https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 3.4.4

    - CVE-2015-1868

Release notes:
https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-3 44

External References:
https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
87952	PowerDNS Recursor 3.x < 3.7.3 Label Decompression DoS	Nessus	DNS	high
87946	PowerDNS Authoritative Server 3.x < 3.4.5 Label Decompression Self-Referential Name Handling DoS	Nessus	DNS	high
84996	openSUSE Security Update : pdns / pdns-recursor (openSUSE-2015-505)	Nessus	SuSE Local Security Checks	high
83229	FreeBSD : powerdns -- Label decompression bug can cause crashes or CPU spikes (64e6006e-f009-11e4-98c6-000c292ee6b8)	Nessus	FreeBSD Local Security Checks	high
83222	Fedora 20 : pdns-recursor-3.7.2-1.fc20 (2015-7079)	Nessus	Fedora Local Security Checks	high
83221	Fedora 20 : pdns-3.3.1-3.fc20 (2015-7057)	Nessus	Fedora Local Security Checks	high
83220	Fedora 21 : pdns-3.4.4-1.fc21 (2015-7047)	Nessus	Fedora Local Security Checks	high
83219	Fedora 22 : pdns-recursor-3.7.2-1.fc22 (2015-7033)	Nessus	Fedora Local Security Checks	high
83218	Fedora 21 : pdns-recursor-3.7.2-1.fc21 (2015-7031)	Nessus	Fedora Local Security Checks	high
83217	Fedora 22 : pdns-3.4.4-1.fc22 (2015-7018)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2015-1868

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high