CVE-2017-15093

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. I...

CVE-2017-15094

An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or...

CVE-2017-15094

An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or...

CVE-2017-15093

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. I...

CVE-2017-15092

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content...

CVE-2017-15090

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...

CVE-2017-15092: Improper Neutralization of Input During Web Page Generation

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content...

PT-2018-5760

Name of the Vulnerable Software and Affected Versions: PowerDNS Recursor versions 3.x up to and including 3.7.4 PowerDNS Recursor versions 4.x up to and including 4.0.6 Description: The issue allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure...

CVE-2017-15093: Improper Input Validation

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. I...

PT-2018-5761

Name of the Vulnerable Software and Affected Versions: PowerDNS Recursor versions 4.0.0 through 4.0.6 Description: A memory leak issue has been found in the DNSSEC parsing code when parsing specially crafted DNSSEC ECDSA keys. This issue occurs when validation is enabled by setting dnssec to a...

PT-2018-5757

Name of the Vulnerable Software and Affected Versions: PowerDNS Recursor versions 4.0.0 through 4.0.6 Description: The issue is related to the DNSSEC validation component, where signatures might be accepted as valid even if the signed data is not in the bailiwick of the DNSKEY used to sign it. Th...

PT-2018-5759

Name of the Vulnerable Software and Affected Versions: PowerDNS Recursor versions 4.0.0 through 4.0.6 Description: A cross-site scripting issue has been found in the web interface, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and...

CVE-2017-15094: Missing Release of Memory after Effective Lifetime

An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or...

CVE-2017-15090: Improper Verification of Cryptographic Signature

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...

powerdns-recursor -- insufficient validation of DNSSEC signatures

PowerDNS Security Advisory reports: An issue has been found in the DNSSEC validation component of PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3 record to be used to wrongfully prove the non-existence of a RR below the owner name of that record. This would allow an attacker in...

PowerDNS Recursor 4.0.x < 4.0.8 CNAME Parser DoS (CVE-2017-15120)

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 4.0.x prior to 4.0.8. It is, therefore, affected by a denial of service vulnerability in the CNAME parser. Note that Nessus has not attempted to exploit these issues but has...

PowerDNS Recursor < 4.0.7 API Configuration Injection Vulnerability (CVE-2017-15093)

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is prior to to 4.0.7. It is, therefore, affected by a vulnerability where a remote authenticated user can injection additional configuration directives via the API. Note that Nessus ha...

PowerDNS Recursor 4.0.x < 4.0.7 Multiple Vulnerabilities

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 4.0.x prior to 4.0.7. It is, therefore, affected by multiple vulnerabilities: - Insufficient validation of DNSSEC signatures. CVE-2017-15090 - Cross-Site Scripting XSS in th...

Fedora 27 : pdns-recursor (2017-608b6f5945)

Update to latest version. Contains security fixes for CVE-2017-15090, CVE-2017-15092, CVE-2017-15093 and CVE-2017-15094 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

openSUSE Security Update : pdns-recursor (openSUSE-2017-1395)

This update for pdns-recursor fixes the following issues : - CVE-2017-15120: parsing error while handling authoritative answers containing a CNAME of a different class than IN, leading to a recursor crash via a NULL pointer dereference. boo1072170 %NASLMINLEVEL 70300 C Tenable Network Security,...