PT-2020-3620 · Powerdns+1 · Powerdns Recursor+1

Matt Nordhoff · Published 2020-05-19 · Updated 2024-06-15 · CVE-2020-12244

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions PowerDNS Recursor versions 4.1.0 through 4.3.0

Description The issue concerns a lack of proper validation in the SyncRes::processAnswer function for records in the answer section of a NXDOMAIN response that lacks an SOA. This allows an attacker to bypass DNSSEC validation. The vulnerability is related to insufficient input validation in the SyncRes::processAnswer function of the PowerDNS Recursor, which could allow a remote attacker to access confidential data.

Recommendations For PowerDNS Recursor versions 4.1.0 through 4.3.0, consider updating to a version that includes a fix for the issue in the SyncRes::processAnswer function to prevent DNSSEC validation bypass. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

RCE

Weakness Enumeration

CWE-347

CWE-20

Related Identifiers

BDU:2020-03964

CVE-2020-12244

DSA-4691-1

MGASA-2020-0223

OPENSUSE-SU-2020:0698-1

OPENSUSE-SU-2020_0698-1

OPENSUSE-SU-2024:11157-1

Affected Products

Powerdns Recursor

Suse

References · 47

• https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-02.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF · Vendor Advisory
• https://debian.org/security/2020/dsa-4691 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-12244 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NMP72NJGKBWR5WEBXAWX5KSLQUDFTG6S · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0698-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMP72NJGKBWR5WEBXAWX5KSLQUDFTG6S · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03964 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12244 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00052.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11157-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12244 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0223.html · Security Note
• https://osv.dev/vulnerability/CVE-2020-12244 · Vendor Advisory