Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.

This update for knot fixes the following issues :

  - CVE-2017-11104: Fixed an improper implementation of TSIG     protocol which could have allowed an attacker with a     valid key name and algorithm to bypass TSIG     authentication (boo#1047841).

This update for knot fixes the following issues :

  - CVE-2017-11104: Knot DNS contained a flaw within the     TSIG protocol implementation that would allow an     attacker with a valid key name and algorithm to bypass     TSIG authentication if no additional ACL restrictions     are set, because of an improper TSIG validity period     check. (boo#1047841)

The Knot DNS server running on the remote host is version 2.4.x prior to 2.4.5 or 2.5.x prior to 2.5.2. It is, therefore, affected by a TSIG authentication bypass vulnerability.

New upstream release: 2.4.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Clement Berthaux from Synaktiv discovered a signature forgery vulnerability in knot, an authoritative-only DNS server. This vulnerability allows an attacker to bypass TSIG authentication by sending crafted DNS packets to a server.

ID	Name	Product	Family	Severity
139014	openSUSE Security Update : knot (openSUSE-2020-1086)	Nessus	SuSE Local Security Checks	medium
139013	openSUSE Security Update : knot (openSUSE-2020-1085)	Nessus	SuSE Local Security Checks	medium
110067	openSUSE Security Update : knot (openSUSE-2018-494)	Nessus	SuSE Local Security Checks	medium
106196	Knot DNS 2.4.x < 2.4.4 / 2.5.x < 2.5.2 TSIG Authentication Bypass Vulnerability (CVE-2017-11104)	Nessus	DNS	medium
101871	Fedora 26 : knot (2017-d3d38a53f9)	Nessus	Fedora Local Security Checks	medium
101555	Debian DSA-3910-1 : knot - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-11104

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium