UBUNTU-CVE-2020-24697

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can cause a denial of service by sending crafted queries with a GSS-TSIG signature...

UBUNTU-CVE-2020-24696

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature...

UBUNTU-CVE-2020-24698

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able to cause a double-free, leading to a crash or possibly arbitrary code execution. by sending crafted queries with a GSS-TSIG signature...

CVE-2020-24698

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able to cause a double-free, leading to a crash or possibly arbitrary code execution. by sending crafted queries with a GSS-TSIG signature...

CVE-2020-24698

CVE-2020-24698 affects PowerDNS Authoritative Server up to version 4.3.0. An attacker can send crafted queries with a GSS-TSIG signature to a remote, unauthenticated endpoint, potentially triggering a double-free that leads to a crash or possibly arbitrary code execution. This is tied to the GSS-...

CVE-2020-24697

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can cause a denial of service by sending crafted queries with a GSS-TSIG signature...

CVE-2020-24697

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can cause a denial of service by sending crafted queries with a GSS-TSIG signature...

CVE-2020-24696

PowerDNS Authoritative Server (up to 4.3.0) is affected via GSS-TSIG support. A remote, unauthenticated attacker can trigger a race condition by sending crafted queries with a GSS-TSIG signature, potentially causing a crash or arbitrary code execution. Impact is demonstrated as partial confidenti...

CVE-2020-24696

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature...

CVE-2020-24696

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature...

Vulnerabilities fixed in PowerDNS

Vulnerabilities have been fixed in PowerDNS. The vulnerabilities enable an unauthenticated remote malicious agent to cause a denial-of-service and to potentially execute arbitrary code to execute under the user's privileges. This applies only to installations compiled with...

PT-2020-15811 · Powerdns +1 · Powerdns Authoritative +2

Name of the Vulnerable Software and Affected Versions: PowerDNS Authoritative versions prior to 4.3.0 Description: A denial of service issue was discovered when the --enable-experimental-gss-tsig option is used. This allows a remote, unauthenticated attacker to cause a denial of service by sendin...

PT-2020-15810 · Powerdns +1 · Powerdns Authoritative +2

Name of the Vulnerable Software and Affected Versions: PowerDNS Authoritative versions prior to 4.3.0 Description: A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature when th...

Denial Of Service (DoS)

Wireshark is vulnerable to denial of service DoS. the GSS-API dissector could crash due to a flaw in epan/dissectors/packet-gssapi.c if a valid dissector is not called...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4485-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4485-1 advisory. Timothy Michaud discovered that the i915 graphics driver in the Linux kernel did not properly validate user memory locations for the...

powerdns -- Various issues in GSS-TSIG support

PowerDNS developers report: A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature. A remote, unauthenticated attacker can cause a denial of service by sending crafted queries...

CVE-2020-12656

A flaw was found in the implementation of the Linux kernel’s GSS mechanism registration functionality. During this period, memory allocation was not freed when the module was unloaded, leading to a memory leak. This flaw allows an attacker with the ability to repeat loads and unloads, to cause th...

Linux kernel memory leak vulnerability (CNVD-2020-37936)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A memory leak vulnerability exists in the 'gssmechfree' function of the net/sunrpc/authgss/gssmechswitch.c file in Linux kernel 5.6.10 and earlier, which can be...

DEBIAN-CVE-2020-12656

gssmechfree in net/sunrpc/authgss/gssmechswitch.c in the rpcsecgsskrb5 implementation in the Linux kernel through 5.6.10 lacks certain domainrelease calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a...

UBUNTU-CVE-2020-12656

gssmechfree in net/sunrpc/authgss/gssmechswitch.c in the rpcsecgsskrb5 implementation in the Linux kernel through 5.6.10 lacks certain domainrelease calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a...