Description
Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS, (2) AXFR, or (3) IXFR.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | knot | 2.3.0-1 | — |
| Debian 13 | knot | 2.3.0-1 | — |
| Debian 12 | knot | 2.3.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | knot | No fix yet | — |
References
- [oss-security] 20160706 Malicious primary DNS servers can crash secondaries mailing-list
- 91678 vdb-entry
- [dns-operations] 20160704 DNS activities in Japan mailing-list
- [oss-security] 20160706 Re: Malicious primary DNS servers can crash secondaries mailing-list
- https://gitlab.labs.nic.cz/labs/knot/blob/c546a70563ef4c7badb7cb5bdf6d1ba8e7adae82/NEWS
- https://gitlab.labs.nic.cz/labs/knot/issues/464
- https://github.com/sischkg/xfer-limit/blob/master/README.md