904 matches found
CVE-2017-15094
PowerDNS Recursor (4.0.0–4.0.6) has a memory leak in the DNSSEC parsing path when processing DNSSEC ECDSA keys with validation enabled (dnssec not off/process-no-validate). Affected component: DNSSEC parsing code in the Recursor. Impact: memory leak; no explicit exploitation details provided in t...
CVE-2017-15092
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content...
CVE-2017-15094
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or...
CVE-2017-15090
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...
CVE-2017-15094
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or...
CVE-2017-15093
When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. I...
CVE-2017-15090
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...
CVE-2017-15092
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content...
CVE-2017-15093
CVE-2017-15093 affects PowerDNS Recursor (4.x up to 4.0.6 and 3.x up to 3.7.4). An authenticated user can modify the Recursor’s ACL by adding/removing netmasks and configure forward zones when api-config-dir is non-empty. The root cause is insufficient validation of the new netmask and IP address...
CVE-2017-15093
When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. I...
CVE-2017-15093
When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. I...
CVE-2017-15094
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or...
CVE-2017-15092
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content...
CVE-2017-15090
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...
CVE-2017-15092
CVE-2017-15092 affects PowerDNS Recursor web interface (4.0.0–4.0.6): the qname field in DNS queries is displayed without escaping, enabling a remote attacker to inject HTML/JavaScript and alter the interface content. Connected sources confirm the issue and reference affected versions; some feeds...
CVE-2017-15090
The CVE concerns PowerDNS Recursor 4.0.0–4.0.6, where the DNSSEC validation component could incorrectly accept signatures as valid even when the signed data was not within the DNSKEY signer’s bailiwick. This could let a man-in-the-middle attacker modify DNS records by issuing a valid signature fo...
powerdns-recursor -- insufficient validation of DNSSEC signatures
PowerDNS Security Advisory reports: An issue has been found in the DNSSEC validation component of PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3 record to be used to wrongfully prove the non-existence of a RR below the owner name of that record. This would allow an attacker in...
PowerDNS Recursor < 4.0.7 API Configuration Injection Vulnerability (CVE-2017-15093)
According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is prior to to 4.0.7. It is, therefore, affected by a vulnerability where a remote authenticated user can injection additional configuration directives via the API. Note that Nessus ha...
PowerDNS Recursor 4.0.x < 4.0.8 CNAME Parser DoS (CVE-2017-15120)
According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 4.0.x prior to 4.0.8. It is, therefore, affected by a denial of service vulnerability in the CNAME parser. Note that Nessus has not attempted to exploit these issues but has...
PowerDNS Recursor 4.0.x < 4.0.7 Multiple Vulnerabilities
According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 4.0.x prior to 4.0.7. It is, therefore, affected by multiple vulnerabilities: - Insufficient validation of DNSSEC signatures. CVE-2017-15090 - Cross-Site Scripting XSS in th...