Null pointer accces in aggressive NSEC(3) cache
A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.
Published Updated
PatchFirst · Latest vulnerabilities
pdns-recursor vulnerabilities · Page 2
Vulnerabilities published for pdns-recursor in the last 30 days: 7. Listed in the KEV catalogue: 0.
Vulnerabilities: 62
Insufficient input validation of internal webserver
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Published UpdatedConcurrent modification of RPZ data can lead to denial of servce
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
Published UpdatedCrafted zones can cause increased resource usage
By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.
Published UpdatedInsufficient input validation of internal webserver
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Published UpdatedUnbounded memory allocation by internal web server
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Published UpdatedInsufficient validation of zonemd record
If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.
Published UpdatedNull pointer dereference in RPZ transfer
An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.
Published UpdatedCrafted delegations or IP fragments can poison cached delegations in Recursor
Crafted delegations or IP fragments can poison cached delegations in Recursor.
Published UpdatedCrafted delegations or IP fragments can poison cached delegations in Recursor
Crafted delegations or IP fragments can poison cached delegations in Recursor.
Published UpdatedCrafted zones can lead to increased incoming network traffic
Crafted zones can lead to increased incoming network traffic.
Published UpdatedCrafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor
Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.
Published UpdatedInternal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor
An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.
Published UpdatedInsufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.
Published UpdatedA Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts
An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and enforcing stricter validation of the received answers. The most strict mitigation done when the new setting outgoing.edns_subnet_harden (old style name edns-subnet-harden) is enabled.
Published UpdatedA crafted zone can lead to an illegal memory access in the PowerDNS Recursor
An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service. The remedy is: upgrade to the patched 5.2.1 version. We would like to thank Volodymyr Ilyin for bringing this issue to our attention.
Published UpdatedCrafted responses can lead to a denial of service due to cache inefficiencies in the Recursor
An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can lead to a denial of service.
Published UpdatedCrafted responses can lead to a denial of service in Recursor if recursive forwarding is configured
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
Published UpdatedCVE-2023-50868
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
Published UpdatedCVE-2023-50387
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.