An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever, leading to a possible replay attack.

- Update to 4.0.3

  - Security fix for CVE-2016-2120, CVE-2016-7068,     CVE-2016-7072, CVE-2016-7073, CVE-2016-7074

Release notes 4.0.2:
https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-4 02 Release notes 4.0.3:
https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-4 03

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2016-2120

Mathieu Lafon discovered that pdns does not properly validate records in zones. An authorized user can take advantage of this flaw to crash server by inserting a specially crafted record in a zone under their control and then sending a DNS query for that record.

CVE-2016-7068

Florian Heinz and Martin Kluge reported that pdns parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a partial denial of service if the system becomes overloaded.

CVE-2016-7072

Mongo discovered that the webserver in pdns is susceptible to a denial of service vulnerability. A remote, unauthenticated attacker to cause a denial of service by opening a large number of f TCP connections to the web server.

CVE-2016-7073 / CVE-2016-7074

Mongo discovered that pdns does not sufficiently validate TSIG signatures, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR.

For Debian 7 'Wheezy', these problems have been fixed in version 3.1-4.1+deb7u3.

We recommend that you upgrade your pdns packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-2120, CVE-2016-7068, CVE-2016-7072, CVE-2016-7073, CVE-2016-7074

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PowerDNS reports :

2016-02: Crafted queries can cause abnormal CPU usage

2016-03: Denial of service via the web server

2016-04: Insufficient validation of TSIG signatures

2016-05: Crafted zone record can cause a denial of service

This update for pdns fixes the following issues :

  - CVE-2016-2120: Crafted zone record could have caused a     denial of service (bsc#1018329).

  - CVE-2016-7068: Crafted queries could have caused     abnormal CPU usage (bsc#1018326).

  - CVE-2016-7072: Denial of service via the web server     (bsc#1018327).

  - CVE-2016-7073: Fixed insufficient validation of TSIG     signatures (bsc#1018328).

  - CVE-2016-7074: Fixed insufficient validation of TSIG     signatures ((bsc#1018328).

Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-2120     Mathieu Lafon discovered that pdns does not properly     validate records in zones. An authorized user can take     advantage of this flaw to crash server by inserting a     specially crafted record in a zone under their control     and then sending a DNS query for that record.

  - CVE-2016-7068     Florian Heinz and Martin Kluge reported that pdns parses     all records present in a query regardless of whether     they are needed or even legitimate, allowing a remote,     unauthenticated attacker to cause an abnormal CPU usage     load on the pdns server, resulting in a partial denial     of service if the system becomes overloaded.

  - CVE-2016-7072     Mongo discovered that the webserver in pdns is     susceptible to a denial-of-service vulnerability,     allowing a remote, unauthenticated attacker to cause a     denial of service by opening a large number of TCP     connections to the web server.

  - CVE-2016-7073 / CVE-2016-7074     Mongo discovered that pdns does not sufficiently     validate TSIG signatures, allowing an attacker in     position of man-in-the-middle to alter the content of an     AXFR.

ID	Name	Product	Family	Severity
96897	Fedora 24 : pdns (2017-bb0b9ddf27)	Nessus	Fedora Local Security Checks	high
96849	Fedora 25 : pdns (2017-cbd5501d31)	Nessus	Fedora Local Security Checks	high
96779	Debian DLA-798-1 : pdns security update	Nessus	Debian Local Security Checks	high
96739	Fedora 25 : pdns-recursor (2017-c1ae4335e5)	Nessus	Fedora Local Security Checks	high
96738	Fedora 24 : pdns-recursor (2017-8308bc2a6e)	Nessus	Fedora Local Security Checks	high
96620	FreeBSD : powerdns -- multiple vulnerabilities (e3200958-dd6c-11e6-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
96583	openSUSE Security Update : pdns (openSUSE-2017-112)	Nessus	SuSE Local Security Checks	high
96497	Debian DSA-3764-1 : pdns - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-7073

medium

Tenable Plugins

high

high

high

high

high

high

high

high