CVE-2012-1193 in PowerDNS Recursor
Summary
by MITRE
The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/30/2021
The vulnerability identified as CVE-2012-1193 affects PowerDNS Recursor version 3.3, specifically targeting the resolver component responsible for handling DNS queries. This flaw represents a critical cache poisoning vulnerability that exploits the improper handling of NS record caching during A record query processing. The issue stems from the recursor's failure to properly validate and maintain the integrity of cached DNS records, particularly when processing responses that contain both A and NS records simultaneously. The vulnerability enables attackers to manipulate the caching behavior of the DNS resolver in a manner that can persistently affect domain resolution even after the original domain has been revoked or expired.
The technical mechanism behind this vulnerability involves the recursor's handling of authoritative responses where NS records contain server names and TTL values that get overwritten during the processing of A record queries. When the recursor receives a response containing both A and NS records for the same domain, it incorrectly updates the cached NS records with data from the A record processing cycle, effectively corrupting the cached information. This behavior creates a scenario where attackers can inject malicious NS record data that persists in the cache, allowing them to maintain continued resolvability of domain names that should no longer be accessible. The flaw operates at the intersection of DNS caching mechanisms and record processing logic, specifically affecting how the recursor manages TTL values and server name resolution during multi-record response handling.
The operational impact of this vulnerability is significant as it enables persistent DNS cache poisoning attacks that can maintain control over domain resolution for extended periods. Attackers can leverage this vulnerability to create "ghost domain names" that continue to resolve to malicious IP addresses even after legitimate domain expiration or revocation. This capability undermines the fundamental trust model of DNS resolution and can facilitate various malicious activities including phishing attacks, redirection of traffic to malicious servers, and bypassing of security controls that depend on proper DNS resolution behavior. The attack vector requires remote access to the vulnerable DNS resolver and can be executed without authentication, making it particularly dangerous in environments where DNS resolvers are exposed to untrusted networks.
This vulnerability maps to CWE-119 Improper Restriction of Operations within a Memory Buffer and CWE-347 Improper Verification of Cryptographic Signature, as it involves improper handling of memory operations during DNS record processing and potential manipulation of cached data integrity. From an ATT&CK framework perspective, this vulnerability aligns with T1071.004 Application Layer Protocol: DNS and T1566.001 Phishing: Spearphishing Attachment, as it enables persistent DNS-based attacks that can be used to support broader social engineering campaigns. The vulnerability also relates to T1496 Resource Hijacking as it allows attackers to maintain control over domain resolution resources beyond their legitimate expiration periods. Organizations using PowerDNS Recursor 3.3 should implement immediate mitigations including upgrading to patched versions, implementing proper DNS cache validation mechanisms, and monitoring for suspicious DNS resolution patterns that could indicate cache poisoning activity.
The remediation approach for CVE-2012-1193 requires immediate deployment of patched versions of PowerDNS Recursor that address the specific caching behavior flaw. Organizations should also implement additional defensive measures such as DNS cache monitoring, rate limiting for DNS queries, and network segmentation to limit exposure of vulnerable DNS resolvers. The vulnerability demonstrates the importance of proper cache validation and record integrity checking in DNS resolution systems, highlighting how seemingly minor implementation flaws can create significant security risks in critical infrastructure components. Security teams should conduct thorough vulnerability assessments to identify all instances of the affected software and ensure proper patch management procedures are in place to prevent similar issues from arising in the future.