PT-2019-16732 · Powerdns · Powerdns Recursor

Dhananjay Arunesh · Published 2019-01-23 · Updated 2024-06-15 · CVE-2019-3806

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PowerDNS Recursor versions 4.1.3 through 4.1.8

Description The issue concerns the improper application of Lua hooks to queries received over TCP in specific settings, potentially bypassing security policies enforced using Lua. This could lead to security breaches due to the failure of Lua hooks to properly filter or manage incoming queries.

Recommendations For PowerDNS Recursor versions 4.1.3 through 4.1.8, update to version 4.1.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of TCP queries or reviewing and adjusting Lua hook configurations to minimize the risk of exploitation.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

CVE-2019-3806

MGASA-2019-0051

OPENSUSE-SU-2019:0131-1

OPENSUSE-SU-2024:11157-1

Affected Products

Powerdns Recursor

References · 36

• https://osv.dev/vulnerability/openSUSE-SU-2024:11157-1 · Vendor Advisory
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0051 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3806 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:0131-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-3806 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-3806 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-3806 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3806 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3806 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0051.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-3806 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-2120 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806 · Note
• https://bugzilla.suse.com/1121889 · Note