Bug 943078 (CVE-2015-5230) - VUL-0: CVE-2015-5230: pdns: possible DoS with generated query packets
Summary: VUL-0: CVE-2015-5230: pdns: possible DoS with generated query packets
Status: RESOLVED FIXED
Alias: CVE-2015-5230
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.2
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-08-25 12:26 UTC by Alexander Bergmann
Modified: 2017-01-05 12:29 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 2 Swamp Workflow Management 2015-08-25 22:01:06 UTC
bugbot adjusting priority
Comment 4 Marcus Meissner 2015-09-02 13:28:55 UTC
public now.

From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Wed, 2 Sep 2015 15:24:48 +0200

Subject: [oss-security] PowerDNS Security Advisory 2015-02

--j0kOLkWT6rQjsDKepPmPjKluHIsd2Fu4r
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hi all,

We'd like to make you aware of Security Advisory 2015-02 for PowerDNS.

A bug was recently found in our DNS packet parsing/generation code,
which, when exploited, can cause individual threads (disabling service)
or whole processes (allowing a supervisor to restart them) to crash with
just one or a few query packets.

* CVE: CVE-2015-5230
* Date: 2nd of September 2015
* Credit: Pyry Hakulinen and Ashish Shakla at Automattic
* Affects: PowerDNS Authoritative Server 3.4.0 through 3.4.5
* Not affected: PowerDNS Authoritative Server 3.4.6
* Severity: High
* Impact: Degraded service or Denial of service
* Exploit: This problem can be triggered by sending specially crafted
  query packets
* Risk of system compromise: No
* Solution: Upgrade to a non-affected version
* Workaround: Run the Authoritative Server inside a supervisor when
  `distributor-threads`  is set to `1` to prevent Denial of Service.
  No workaround for the degraded service exists

PowerDNS Authoritative Server 3.4.0-3.4.5 are affected. No other
versions are affected. The PowerDNS Recursor is not affected.

PowerDNS Authoritative Server 3.4.6 contains a fix to this issue. A
minimal patch is available [1].

This issue is entirely unrelated to Security Advisory 2015-01/CVE-2015-18=
68.

We'd like to thank Pyry Hakulinen and Ashish Shakla at Automattic for
finding and subsequently reporting this bug.

1 - https://downloads.powerdns.com/patches/2015-02/

--=20
Pieter Lexis
PowerDNS.COM BV - https://www.powerdns.com
Comment 5 Michael Ströder 2015-09-08 13:35:51 UTC
I've already updated pdns package to upstream release 3.4.6 6 days ago. It works on Tumbleweed x86_64 and Factory ARM armv6.

https://build.opensuse.org/package/show/server:dns/pdns
Comment 6 Adam Majer 2016-08-17 11:25:34 UTC
This bug looks like it doesn't affect either 42.1 or 13.2, so reassigning back to security team.

  pdns-3.3.1 in 13.2
  pdns-3.4.6 in 42.1
Comment 7 Andreas Stieger 2017-01-05 12:29:50 UTC
thanks all, closing