Bugzilla – Bug 943078
VUL-0: CVE-2015-5230: pdns: possible DoS with generated query packets
Last modified: 2017-01-05 12:29:50 UTC
bugbot adjusting priority
public now. From: Pieter Lexis <pieter.lexis@powerdns.com> Date: Wed, 2 Sep 2015 15:24:48 +0200 Subject: [oss-security] PowerDNS Security Advisory 2015-02 --j0kOLkWT6rQjsDKepPmPjKluHIsd2Fu4r Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, We'd like to make you aware of Security Advisory 2015-02 for PowerDNS. A bug was recently found in our DNS packet parsing/generation code, which, when exploited, can cause individual threads (disabling service) or whole processes (allowing a supervisor to restart them) to crash with just one or a few query packets. * CVE: CVE-2015-5230 * Date: 2nd of September 2015 * Credit: Pyry Hakulinen and Ashish Shakla at Automattic * Affects: PowerDNS Authoritative Server 3.4.0 through 3.4.5 * Not affected: PowerDNS Authoritative Server 3.4.6 * Severity: High * Impact: Degraded service or Denial of service * Exploit: This problem can be triggered by sending specially crafted query packets * Risk of system compromise: No * Solution: Upgrade to a non-affected version * Workaround: Run the Authoritative Server inside a supervisor when `distributor-threads` is set to `1` to prevent Denial of Service. No workaround for the degraded service exists PowerDNS Authoritative Server 3.4.0-3.4.5 are affected. No other versions are affected. The PowerDNS Recursor is not affected. PowerDNS Authoritative Server 3.4.6 contains a fix to this issue. A minimal patch is available [1]. This issue is entirely unrelated to Security Advisory 2015-01/CVE-2015-18= 68. We'd like to thank Pyry Hakulinen and Ashish Shakla at Automattic for finding and subsequently reporting this bug. 1 - https://downloads.powerdns.com/patches/2015-02/ --=20 Pieter Lexis PowerDNS.COM BV - https://www.powerdns.com
I've already updated pdns package to upstream release 3.4.6 6 days ago. It works on Tumbleweed x86_64 and Factory ARM armv6. https://build.opensuse.org/package/show/server:dns/pdns
This bug looks like it doesn't affect either 42.1 or 13.2, so reassigning back to security team. pdns-3.3.1 in 13.2 pdns-3.4.6 in 42.1
thanks all, closing