PowerDNS Authoritative Server up to 3.4.10/4.0.1 Zone integer overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in PowerDNS Authoritative Server up to 3.4.10/4.0.1. The impacted element is an unknown function of the component Zone Handler. Such manipulation leads to integer overflow. This vulnerability is documented as CVE-2016-2120. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in PowerDNS Authoritative Server up to 3.4.10/4.0.1 (Domain Name Software). It has been rated as critical. Affected by this issue is an unknown functionality of the component Zone Handler. The manipulation with an unknown input leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record. The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary.

The bug was discovered 10/31/2018. The weakness was released 10/31/2018 as not defined bug report (Bugzilla). The advisory is available at bugzilla.redhat.com. This vulnerability is handled as CVE-2016-2120 since 01/28/2016. The exploitation is known to be easy. The attack may be launched remotely. The successful exploitation needs a simple authentication. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 96849 (Fedora 25 : pdns (2017-cbd5501d31)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 169667 (OpenSuSE Security Update for pdns (openSUSE-SU-2017:0183-1)).

Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (96849). Entries connected to this vulnerability are available at VDB-123797, VDB-123888, VDB-123891 and VDB-123892. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Domain Name Software

Vendor

• PowerDNS

Name

• Authoritative Server

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10
• 4.0.0
• 4.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion