[manjaro-security] [arch-security] [ASA-201711-31] powerdns-recursor: multiple issues

Remi Gacogne via arch-security arch-security at archlinux.org
Tue Nov 28 00:04:24 CET 2017

Arch Linux Security Advisory ASA-201711-31

Severity: Medium
Date    : 2017-11-27
CVE-ID  : CVE-2017-15090 CVE-2017-15092 CVE-2017-15093 CVE-2017-15094
Package : powerdns-recursor
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-520


The package powerdns-recursor before version 4.0.7-1 is vulnerable to
multiple issues including cross-site scripting, denial of service and
insufficient validation.


Upgrade to 4.0.7-1.

# pacman -Syu "powerdns-recursor>=4.0.7-1"

The problems have been fixed upstream in version 4.0.7.


It is possible to work around CVE-2017-15093 by disabling the ability
to alter the configuration via the API by setting 'api-config-dir' to
an empty value (default), or by marking the API read-only via the 'api-
readonly' setting.


- CVE-2017-15090 (insufficient validation)

An issue has been found in the DNSSEC validation component of PowerDNS
Recursor from 4.0.0 up to and including 4.0.5, where the signatures
might have been accepted as valid even if the signed data was not in
bailiwick of the DNSKEY used to sign it. This allows an attacker in
position of man-in-the-middle to alter the content of records by
issuing a valid signature for the crafted records.

- CVE-2017-15092 (cross-site scripting)

An issue has been found in the web interface of PowerDNS Recursor from
4.0.0 and up to and including 4.0.6, where the qname of DNS queries was
displayed without any escaping, allowing a remote attacker to inject
HTML and Javascript code into the web interface, altering the content.

- CVE-2017-15093 (insufficient validation)

An issue has been found in the API of PowerDNS Recursor < 4.0.7, during
a source code audit by Nixu. When 'api-config-dir' is set to a non-
empty value, which is not the case by default, the API allows an
authorized user to update the Recursor’s ACL by adding and removing
netmasks, and to configure forward zones. It was discovered that the
new netmask and IP addresses of forwarded zones were not sufficiently
validated, allowing an authenticated user to inject new configuration
directives into the Recursor’s configuration.

- CVE-2017-15094 (denial of service)

An issue has been found in the DNSSEC parsing code of PowerDNS Recursor
from 4.0.0 and up to and including 4.0.6, during a code audit by Nixu,
leading to a memory leak when parsing specially crafted DNSSEC ECDSA
keys. These keys are only parsed when validation is enabled by setting
'dnssec' to a value other than 'off' or 'process-no-validate'


A remote, unauthenticated attacker can inject Javascript code into the
web interface, or can cause a denial of service via crafted DNSSEC
signatures. An attacker in position of man-in-the-middle can also
bypass DNSSEC validation via a crafted signature. In addition to that,
a remote authenticated attacker with access to the API can inject
unexpected directives into the configuration file.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20171128/c234f128/attachment.sig>

More information about the manjaro-security mailing list