The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 3.x prior to 3.7.3. It is, therefore, affected by a denial of service vulnerability due to improper validation of user-supplied input when handling self-referential names during label decompression. An unauthenticated, remote attacker can exploit this vulnerability, via crafted query packets, to crash the server.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

According to its self-reported version number, the version of the PowerDNS Authoritative Server listening on the remote host is version 3.x prior to 3.4.5. It is, therefore, affected by a denial of service vulnerability due to improper validation of user-supplied input when handling self-referential names during label decompression. An unauthenticated, remote attacker can exploit this, via specially crafted query packets, to crash the server.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch.

pdns, pdns-recursor were updated to fix two security issues.

These security issues were fixed :

  - CVE-2015-1868: The label decompression functionality in     PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x     before 3.7.2 and Authoritative (Auth) Server 3.2.x,     3.3.x before 3.3.2, and 3.4.x before 3.4.4 allowed     remote attackers to cause a denial of service (CPU     consumption or crash) via a request with a name that     refers to itself (bsc#927569).

  - CVE-2015-5470: Complete fix for CVE-2015-1868     (bsc#927569).

Toshifumi Sakaguchi discovered that the patch applied to pdns-recursor, a recursive DNS server, fixing CVE-2015-1868, was insufficient in some cases, allowing remote attackers to cause a denial of service (service-affecting CPU spikes and in some cases a crash).

Toshifumi Sakaguchi discovered that the patch applied to pdns, an authoritative DNS server, fixing CVE-2015-1868, was insufficient in some cases, allowing remote attackers to cause a denial of service (service-affecting CPU spikes and in some cases a crash).

The PowerDNS project reports :

A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to cause crashes. On all platforms, this bug can be abused to cause service-affecting CPU spikes.

ID	Name	Product	Family	Severity
87952	PowerDNS Recursor 3.x < 3.7.3 Label Decompression DoS	Nessus	DNS	high
87946	PowerDNS Authoritative Server 3.x < 3.4.5 Label Decompression Self-Referential Name Handling DoS	Nessus	DNS	high
84996	openSUSE Security Update : pdns / pdns-recursor (openSUSE-2015-505)	Nessus	SuSE Local Security Checks	high
84650	Debian DSA-3307-1 : pdns-recursor - security update	Nessus	Debian Local Security Checks	high
84649	Debian DSA-3306-1 : pdns - security update	Nessus	Debian Local Security Checks	high
83229	FreeBSD : powerdns -- Label decompression bug can cause crashes or CPU spikes (64e6006e-f009-11e4-98c6-000c292ee6b8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-5470

high

Tenable Plugins

high

high

high

high

high

high