CVE-2018-1000003

Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay...

CVE-2018-1000003

CVE-2018-1000003 affects the DNSSEC validation component of PowerDNS Recursor (version 4.1.0). The root cause is improper input validation in the DNSSEC validators, enabling a network attacker in a man‑in‑the‑middle position to replay packets and cause the existence of some DNS data to be denied ...

CVE-2018-1000002

Improper input validation bugs in DNSSEC validators components in Knot Resolver prior version 1.5.2 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay...

CVE-2018-1000003

Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay...

CVE-2018-1000003

Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay...

CVE-2018-1000002

Knot Resolver prior to 1.5.2 contains an insufficient DNSSEC validation flaw (CVE-2018-1000002) that could allow an attacker in MITM to deny existence of some data by forging packets. Fedora advisories and OpenVAS/Nessus entries reference CVE-2018-1000002 and show updates (e.g., knot-resolver pac...

CVE-2017-15107

A vulnerability was found in Dnsmasq's implementation of DNSSEC. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist...

bind: Improper fetch cleanup sequencing in the resolver can cause named to crash

A use-after-free flaw leading to denial of service was found in the way BIND internally handled cleanup operations on upstream recursion fetch contexts. A remote attacker could potentially use this flaw to make named, acting as a DNSSEC validating resolver, exit unexpectedly with an assertion...

PowerDNS Recursor 4.0.x < 4.0.7 Multiple Vulnerabilities

According to its self-reported version number, the version of the PowerDNS Recursor listening on the remote host is version 4.0.x prior to 4.0.7. It is, therefore, affected by multiple vulnerabilities: - Insufficient validation of DNSSEC signatures. CVE-2017-15090 - Cross-Site Scripting XSS in th...

Fedora 27 : knot / knot-resolver (2017-7a7ea1cf50)

"Major update for Knot DNS and Knot Resolver : Knot Resolver 1.5.0 2017-11-02 ================================ Bugfixes -------- - fix loading modules on Darwin Improvements ------------ - new module tasignalquery supporting Signaling Trust Anchor Knowledge using Keytag Query RFC 8145 section 5...

openSUSE Security Update : pdns-recursor (openSUSE-2017-1339)

This update for pdns-recursor fixes the following issues : Security issues fixed : - CVE-2017-15090: An issue has been found in the DNSSEC validation component of PowerDNS Recursor, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY...

[ASA-201711-31] powerdns-recursor: multiple issues

Arch Linux Security Advisory ASA-201711-31 ========================================== Severity: Medium Date : 2017-11-27 CVE-ID : CVE-2017-15090 CVE-2017-15092 CVE-2017-15093 CVE-2017-15094 Package : powerdns-recursor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-5...

Fedora 26 : knot / knot-resolver (2017-31519ecf40)

"Major updates for Knot DNS and Knot Resolver: Knot Resolver 1.5.0 2017-11-02 ================================ Bugfixes -------- - fix loading modules on Darwin Improvements ------------ - new module tasignalquery supporting Signaling Trust Anchor Knowledge using Keytag Query RFC 8145 section 5...

Virtuozzo 7 : bind / bind-chroot / bind-devel / bind-libs / etc (VZLSA-2017-1680)

"An update for bind is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Google to add "DNS over TLS" security feature to Android OS

No doubt your Internet Service Provides ISPs, or network-level hackers cannot spy on https communications. But do you know — ISPs can still see all of your DNS requests, allowing them to know what websites you visit. Google is working on a new security feature for Android that could prevent your...

[SECURITY] Fedora 27 Update: yadifa-2.2.6-1.fc27

YADIFA is a name server implementation developed from scratch by .eu. It is portable across multiple operating systems and supports DNSSEC, TSIG, DNS notify, DNS update, IPv6...

SUSE SLES12 Security Update : dnsmasq (SUSE-SU-2017:2616-1)

This update for dnsmasq fixes the following issues. Remedy the following security issues : - CVE-2017-14491: 2 byte heap based overflow. bsc1060354 - CVE-2017-14492: heap based overflow. bsc1060355 - CVE-2017-14493: stack based overflow. bsc1060360 - CVE-2017-14494: DHCP - info leak. bsc1060361 -...

SUSE-SU-2017:2616-1 Security update for dnsmasq

This update for dnsmasq fixes the following issues. Remedy the following security issues: - CVE-2017-14491: 2 byte heap based overflow. bsc1060354 - CVE-2017-14492: heap based overflow. bsc1060355 - CVE-2017-14493: stack based overflow. bsc1060360 - CVE-2017-14494: DHCP - info leak. bsc1060361 -...

ICANN Postpones Scheduled DNS Crypto Key Rollover

ICANN, the overseer of the Internet’s namespace, announced this week that it was postponing a scheduled change to the cryptographic key that protects the Domain Name System. ICANN said in a statement that the change was to occur on Oct. 11, but new data indicates that a “significant number” of...

DNSSEC Key Signing Key Rollover Postponed

The Internet Corporation for Assigned Names and Numbers ICANN has announced that the change to the Root Zone Key Signing Key KSK scheduled for October 11, 2017, has been postponed. A new date for the Key Roll has not yet been determined. DNSSEC is a set of DNS protocol extensions used to digitall...