A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.

This update for pdns fixes the following issues :

Security issues fixed :

  - CVE-2019-10203: Updated PostgreSQL schema to address a     possible denial of service by an authorized user by     inserting a crafted record in a MASTER type zone under     their control. (boo#1142810)

  - CVE-2019-10162: Fixed a denial of service but when     authorized user to cause the server to exit by inserting     a crafted record in a MASTER type zone under their     control. (boo#1138582)

  - CVE-2019-10163: Fixed a denial of service of slave     server when an authorized master server sends large     number of NOTIFY messages. (boo#1138582) &#9;
    Non-security issues fixed :

  - Enabled the option to disable superslave support.

  - Fixed `pdnsutil b2b-migrate` to not lose NSEC3 settings.

Two vulnerabilities have been discovered in pdns, an authoritative DNS server which may result in denial of service via malformed zone records and excessive NOTIFY packets in a master/slave setup.

CVE-2019-10162

An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.

CVE-2019-10163

An issue has been found in PowerDNS Authoritative Server allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.

For Debian 8 'Jessie', these problems have been fixed in version 3.4.1-4+deb8u10.

We recommend that you upgrade your pdns packages.

For the detailed security status of pdns please refer to its security tracker page at: https://security-tracker.debian.org/tracker/pdns

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PowerDNS Team reports :

CVE-2019-10162: An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control.
The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.

CVE-2019-10163: An issue has been found in PowerDNS Authoritative Server allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.

Two vulnerabilities have been discovered in pdns, an authoritative DNS server which may result in denial of service via malformed zone records and excessive NOTIFY packets in a master/slave setup.

ID	Name	Product	Family	Severity
127996	openSUSE Security Update : pdns (openSUSE-2019-1904)	Nessus	SuSE Local Security Checks	high
126481	Debian DLA-1843-1 : pdns security update	Nessus	Debian Local Security Checks	high
126363	FreeBSD : powerdns -- multiple vulnerabilities (1c21f6a3-9415-11e9-95ec-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	high
126129	Debian DSA-4470-1 : pdns - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-10163

medium

Tenable Plugins

high

high

high

high