Bugzilla – Bug 906583
VUL-0: CVE-2014-8601: pdns: Degraded service through queries to queries to specific domains
Last modified: 2014-12-22 20:13:20 UTC
Via distros. Kind of public since the version is already release. I'm sure solar won't be overjoyed. From: Peter van Dijk <peter.van.dijk@netherlabs.nl> RESTRICTED / EMBARGO UNTIL 8th OF DECEMBER 2014 16:00 UTC Dear valued PowerDNS user, Short version: we recommend that Recursor users upgrade to PowerDNS Recursor 3.6.2 at their earliest convenience. Older versions can be made to provide very bad service using queries to specific domains. PowerDNS Recursor 3.6.2 was released on the 30th of October and is in wide production without problems being reported. Affected: PowerDNS Recursor 3.6.1 and earlier Not affected: PowerDNS Recursor 3.6.2, PowerDNS Authoritative Server Impact: Degraded service Can be triggered remotely: Yes Workaround: None Fix: Upgrade to PowerDNS Recursor 3.6.2, released on the 30th of October 2014 CVE: CVE-2014-8601 Full story: Recently we released PowerDNS Recursor 3.6.2 with a new feature that strictly limits the amount of work we'll perform to resolve a single query. This feature was inspired by performance degradations noted when resolving domains hosted by 'ezdns.it', which can require thousands of queries to resolve. During the 3.6.2 release process, we were contacted by a government security agency with news that they had found that all major caching nameservers, including PowerDNS, could be negatively impacted by specially configured, hard to resolve domain names. With their permission, we continued the 3.6.2 release process with the fix for the issue already in there. On the 8th of December at 4PM UTC, there will be coordinated security releases by all major DNS vendors, except PowerDNS. For PowerDNS, no new release is necessary, but it will become public knowledge at that date that all versions of the recursor BEFORE 3.6.2 are vulnerable. If you need any help upgrading to 3.6.2, please contact us. No problems are expected however since 3.6.2 is in wide production use already. PowerDNS Recursor 3.6.2 can be downloaded via https://www.powerdns.com/downloads.html To contact PowerDNS, please visit https://www.powerdns.com/contact.html
bugbot adjusting priority
public
submitted, sr #264511, #264512, #264514
(In reply to Vladimir Nadvornik from comment #6) > submitted, sr #264511, #264512, #264514 You want to redo that. I just fixed the typo in the changes entry and added the bugnumber in server:dns/pdns-recursor.
ok, submitted again as #264523, #264524, #264525
openSUSE-SU-2014:1685-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 906583 CVE References: CVE-2014-8601 Sources used: openSUSE 13.1 (src): pdns-recursor-3.6.2-8.4.1 openSUSE 12.3 (src): pdns-recursor-3.6.2-6.4.1
released