In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3855 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3855-1 debian-lts@lists.debian.org     https://www.debian.org/lts/security/; Daniel Leidert     July 01, 2024 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package : pdns-recursor     Version : 4.1.11-1+deb10u2     CVE ID : CVE-2020-14196 CVE-2020-25829     Debian Bug : 964103 972159

    Brief introduction

    CVE-2020-14196

     The ACL restricting access to the internal web server is not properly      enforced.

    CVE-2020-25829

     A remote attacker can cause the cached records for a given name to be      updated to the Bogus DNSSEC validation state, instead of their actual      DNSSEC Secure state, via a DNS ANY query. This results in a denial of      service for installation that always validate (dnssec=validate), and      for clients requesting validation when on-demand validation is enabled.

    For Debian 10 buster, these problems have been fixed in version     4.1.11-1+deb10u2.

    We recommend that you upgrade your pdns-recursor packages.

    For the detailed security status of pdns-recursor please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/pdns-recursor

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

    Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for pdns-recursor fixes the following issues :

-pdns-recursorwas updated to 4.1.1 and 4.3.5 :

  - CVE-2020-25829: Fixed a cache pollution related to     DNSSEC validation (boo#1177383)

  - CVE-2020-14196: Fixed an access restriction bypass with     API key and password authentication (boo#1173302).

This update for pdns-recursor fixes the following issues :

  - CVE-2020-14196: Fixed an access restriction bypass with     API key and password authentication (boo#1173302).

PowerDNS Team reports :

CVE-2020-14196: An issue has been found in PowerDNS Recursor where the ACL applied to the internal web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send HTTP queries to the internal web server, bypassing the restriction.

In the default configuration the API webserver is not enabled. Only installations using a non-default value for webserver and webserver-address are affected.

ID	Name	Product	Family	Severity
201171	Debian dla-3855 : pdns-recursor - security update	Nessus	Debian Local Security Checks	medium
141530	openSUSE Security Update : pdns-recursor (openSUSE-2020-1687)	Nessus	SuSE Local Security Checks	medium
138671	openSUSE Security Update : pdns-recursor (openSUSE-2020-1005)	Nessus	SuSE Local Security Checks	medium
138127	FreeBSD : powerdns-recursor -- access restriction bypass (641cd669-bc37-11ea-babf-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-14196

medium

Tenable Plugins

medium

medium

medium

medium