Security update for pdns-recursor SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:3218-1 Final 1 1 2017-12-05T20:54:06Z current 2017-12-05T20:54:06Z 2017-12-05T20:54:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pdns-recursor This update for pdns-recursor fixes the following issues: Security issues fixed: - CVE-2017-15090: An issue has been found in the DNSSEC validation component of PowerDNS Recursor, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records (boo#1069242). - CVE-2017-15092: An issue has been found in the web interface of PowerDNS Recursor, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content (boo#1069242). - CVE-2017-15093: When `api-config-dir` is set to a non-empty value, which is not the case by default, the API allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration (boo#1069242). - CVE-2017-15094: An issue has been found in the DNSSEC parsing code of PowerDNS Recursor during a code audit by Nixu, leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys (boo#1069242). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2017-12/msg00021.html E-Mail link for openSUSE-SU-2017:3218-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 openSUSE Leap 42.3 pdns-recursor-4.0.5-3.1 pdns-recursor-4.0.5-3.1 as a component of openSUSE Leap 42.2 pdns-recursor-4.0.5-3.1 as a component of openSUSE Leap 42.3 An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records. CVE-2017-15090 openSUSE Leap 42.2:pdns-recursor-4.0.5-3.1 openSUSE Leap 42.3:pdns-recursor-4.0.5-3.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-12/msg00021.html https://www.suse.com/security/cve/CVE-2017-15090.html CVE-2017-15090 https://bugzilla.suse.com/1069242 SUSE Bug 1069242 A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content. CVE-2017-15092 openSUSE Leap 42.2:pdns-recursor-4.0.5-3.1 openSUSE Leap 42.3:pdns-recursor-4.0.5-3.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-12/msg00021.html https://www.suse.com/security/cve/CVE-2017-15092.html CVE-2017-15092 https://bugzilla.suse.com/1069242 SUSE Bug 1069242 When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration. CVE-2017-15093 openSUSE Leap 42.2:pdns-recursor-4.0.5-3.1 openSUSE Leap 42.3:pdns-recursor-4.0.5-3.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-12/msg00021.html https://www.suse.com/security/cve/CVE-2017-15093.html CVE-2017-15093 https://bugzilla.suse.com/1069242 SUSE Bug 1069242 An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default). CVE-2017-15094 openSUSE Leap 42.2:pdns-recursor-4.0.5-3.1 openSUSE Leap 42.3:pdns-recursor-4.0.5-3.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-12/msg00021.html https://www.suse.com/security/cve/CVE-2017-15094.html CVE-2017-15094 https://bugzilla.suse.com/1069242 SUSE Bug 1069242