PT-2019-16732 · Powerdns · Powerdns Recursor

Dhananjay Arunesh · Publicado 2019-01-23 · Atualizado 2024-06-15 · CVE-2019-3806

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PowerDNS Recursor versions 4.1.3 through 4.1.8

Description The issue concerns the improper application of Lua hooks to queries received over TCP in specific settings, potentially bypassing security policies enforced using Lua. This could lead to security breaches due to the failure of Lua hooks to properly filter or manage incoming queries.

Recommendations For PowerDNS Recursor versions 4.1.3 through 4.1.8, update to version 4.1.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of TCP queries or reviewing and adjusting Lua hook configurations to minimize the risk of exploitation.

Correção

Improperly Implemented Security Check for Standard

Enumeração de Fraquezas

CWE-358

Identificadores relacionados

CVE-2019-3806

MGASA-2019-0051

OPENSUSE-SU-2019:0131-1

OPENSUSE-SU-2024:11157-1

Produtos afetados

Powerdns Recursor

Referências · 36

• https://osv.dev/vulnerability/openSUSE-SU-2024:11157-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-2120 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806 · Nota
• https://bugzilla.suse.com/1121889 · Nota
• https://suse.com/security/cve/CVE-2018-10851 · Nota
• https://bugzilla.suse.com/1121887 · Nota
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-16855 · Nota
• https://osv.dev/vulnerability/MGASA-2019-0051 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-10995 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3806 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-14644 · Nota
• https://suse.com/security/cve/CVE-2020-10030 · Nota
• https://suse.com/security/cve/CVE-2019-3806 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2019:0131-1 · Aviso do Fabricante