PowerDNS Recursor 3.x < 3.1.6 DNS Predictable Transaction ID (TRXID) Cache Poisoning

medium Nessus Plugin ID 34044

Language:

Synopsis

The remote name server is affected by a cache poisoning vulnerability.

Description

According to its self-reported version number, the version of PowerDNS Recursor listening on the remote host is version 3.x prior to 3.1.6.
It is, therefore, affected by a cache poisoning vulnerability due to insufficient randomness to calculate TRXID values and UDP source port numbers. A remote attacker can exploit this poison the DNS cache. This vulnerability was originally fixed in version 3.1.5, but a more secure method was implemented in version 3.1.6.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch or the workaround.

Solution

Upgrade to PowerDNS recursor 3.1.6 or later. Alternatively, apply the patch referenced in the vendor advisory..

Plugin Details

Severity: Medium

ID: 34044

File Name: pdns_recursor_cache_poisining.nasl

Version: 1.17

Type: remote

Family: DNS

Published: 8/25/2008

Updated: 7/24/2018

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:powerdns:powerdns, cpe:/a:powerdns:recursor

Required KB Items: Settings/ParanoidReport, pdns/version, pdns/version_full, pdns/version_source

Exploit Ease: No known exploits are available

Patch Publication Date: 3/31/2008

Vulnerability Publication Date: 3/31/2008

Reference Information

CVE: CVE-2008-1637, CVE-2008-3217

BID: 28517, 30782

CWE: 189

Detections

Analytics