Bug 565286 – <net-dns/pdns-3.4.7: Packet parsing bug can lead to crashes (CVE-2015-5311)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sven Wegener 2015-11-09 20:10:22 UTC]

A bug was found using afl-fuzz in our packet parsing code. This bug, when exploited, causes an assertion error and consequent termination of the the pdns_server process, causing a Denial of Service.

When the PowerDNS Authoritative Server is run inside the guardian (--guardian), or inside a supervisor like supervisord or systemd, it will be automatically restarted, limiting the impact to a somewhat degraded service.

PowerDNS Authoritative Server 3.4.4 - 3.4.6 are affected. No other versions are affected. The PowerDNS Recursor is not affected.

PowerDNS Authoritative Server 3.4.7 contains a fix to this issue.

This issue is unrelated to the issues in our previous two Security Announcements (2015-01 and 2015-02).

Reproducible: Always

[Comment 1 Sven Wegener 2015-11-09 20:11:26 UTC]

I committed 3.4.7 about a week ago.

[Comment 2 Agostino Sarubbo 2015-11-10 08:59:46 UTC]

Arches, please test and mark stable:
=net-dns/pdns-3.4.7
Target keywords : "amd64 x86"

[Comment 3 Agostino Sarubbo 2015-11-10 09:06:39 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2015-11-11 09:41:02 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 5 Yury German 2015-12-31 01:54:47 UTC]

Arches, Thank you for your work.
GLSA Vote: No

Maintainer(s), please drop the vulnerable version(s).