ID CVE-2019-3807
Summary An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.
References
Vulnerable Configurations
  • PowerDNS Recursor 4.1.0
    cpe:2.3:a:powerdns:recursor:4.1.0
  • PowerDNS Recursor 4.1.0 Alpha 1
    cpe:2.3:a:powerdns:recursor:4.1.0:alpha1
  • PowerDNS Recursor 4.1.0 Release Candidate 1
    cpe:2.3:a:powerdns:recursor:4.1.0:rc1
  • PowerDNS Recursor 4.1.0 Release Candidate 2
    cpe:2.3:a:powerdns:recursor:4.1.0:rc2
  • PowerDNS Recursor 4.1.0 Release Candidate 3
    cpe:2.3:a:powerdns:recursor:4.1.0:rc3
  • PowerDNS Recursor 4.1.1
    cpe:2.3:a:powerdns:recursor:4.1.1
  • PowerDNS Recursor 4.1.2
    cpe:2.3:a:powerdns:recursor:4.1.2
  • PowerDNS Recursor 4.1.3
    cpe:2.3:a:powerdns:recursor:4.1.3
  • PowerDNS Recursor 4.1.4
    cpe:2.3:a:powerdns:recursor:4.1.4
CVSS
Base: 6.4
Impact:
Exploitability:
CWE CWE-295
CAPEC
  • Creating a Rogue Certificate Authority Certificate
    An attacker exploits a weakness in the MD5 hash algorithm (weak collision resistance) to generate a certificate signing request (CSR) that contains collision blocks in the "to be signed" part. The attacker specially crafts two different, but valid X.509 certificates that when hashed with the MD5 algorithm would yield the same value. The attacker then sends the CSR for one of the certificates to the Certification Authority which uses the MD5 hashing algorithm. That request is completely valid and the Certificate Authority issues an X.509 certificate to the attacker which is signed with its private key. An attacker then takes that signed blob and inserts it into another X.509 certificate that the attacker generated. Due to the MD5 collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the attackers' second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority. To make the attack more interesting, the second certificate could be not just a regular certificate, but rather itself a signing certificate. Thus the attacker is able to start their own Certification Authority that is anchored in its root of trust in the legitimate Certification Authority that has signed the attackers' first X.509 certificate. If the original Certificate Authority was accepted by default by browsers, so will now the Certificate Authority set up by the attacker and of course any certificates that it signs. So the attacker is now able to generate any SSL certificates to impersonate any web server, and the user's browser will not issue any warning to the victim. This can be used to compromise HTTPS communications and other types of systems where PKI and X.509 certificates may be used (e.g., VPN, IPSec) .
nessus via4
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_40D92CC51E2B11E9BEF66805CA2FA271.NASL
    description PowerDNS Team reports : CVE-2019-3806: An issue has been found in PowerDNS Recursor where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua. When the recursor is configured to run with more than one thread (threads=X) and to do the distribution of incoming queries to the worker threads itself (pdns-distributes-queries=yes), the Lua script is not properly loaded in the thread handling incoming TCP queries, causing the Lua hooks to not be properly applied. CVE-2019-3807: An issue has been found in PowerDNS Recursor where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.
    last seen 2019-02-21
    modified 2019-01-30
    plugin id 121427
    published 2019-01-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=121427
    title FreeBSD : powerdns-recursor -- multiple vulnerabilities (40d92cc5-1e2b-11e9-bef6-6805ca2fa271)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2019-100.NASL
    description This update for pdns-recursor fixes the following issues : - CVE-2019-3807: Fixed insufficient validation of DNSSEC signatures (boo#1121889)
    last seen 2019-02-21
    modified 2019-01-30
    plugin id 121459
    published 2019-01-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=121459
    title openSUSE Security Update : pdns-recursor (openSUSE-2019-100)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2019-F44F095639.NASL
    description Fixes CVE-2019-386 and CVE-2019-3807 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-13
    plugin id 122138
    published 2019-02-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=122138
    title Fedora 29 : pdns-recursor (2019-f44f095639)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2019-7696BB57CA.NASL
    description Fixes CVE-2019-386 and CVE-2019-3807 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-13
    plugin id 122136
    published 2019-02-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=122136
    title Fedora 28 : pdns-recursor (2019-7696bb57ca)
refmap via4
confirm
Last major update 29-01-2019 - 12:29
Published 29-01-2019 - 12:29
Last modified 29-01-2019 - 15:43
Back to Top