Description
PowerDNS Recursor 3.1.3 and earlier allows remote attackers to cause a denial of service (resource exhaustion and application crash) via a CNAME record with a zero TTL, which triggers an infinite loop.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pdns-recursor | 3.1.4-1 | — |
| Debian 13 | pdns-recursor | 3.1.4-1 | — |
| Debian 12 | pdns-recursor | 3.1.4-1 | — |
References
- ADV-2006-4484 vdb-entry
- http://doc.powerdns.com/powerdns-advisory-2006-02.html
- 22824 third-party-advisory
- powerdns-cname-bo(30257) vdb-entry
- SUSE-SA:2006:070 vendor-advisory
- 21037 vdb-entry
- 22976 third-party-advisory