SB2016091001 - Debian update for pdns

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Denial of service (CVE-ID: CVE-2016-5426)

The vulnerability allows a remote user to cause excessive resources spending on the target system.
The weakness exists due to sending of specially crafted DNS queries with length of qname value more than 255 bytes that may lead to denial of service.
The vulnerability may result in consuming of excessive resources and denial of service on the vulnerable system.

2) Denial of service (CVE-ID: CVE-2016-5427)

The vulnerability allows a remote user to cause excessive resources spending on the target system.
The weakness exists due to sending of specially crafted DNS queries with label values containing a dot character ('.') that may lead to denial of service.
The vulnerability may result in consuming of excessive resources and denial of service on the vulnerable system.

3) Improper input validation (CVE-ID: CVE-2016-6172)

The vulnerability allows a remote attacker to cause the target service to crash.

The vulnerability exists due to resource error in PowerDNS. A remote unauthenticated attacker can cause the target service to crash by sending a specially crafted AXFR response or IXFR response.

Successful exploitation of this vulnerability may result in denial of service via network

Remediation

Install update from vendor's website.

References

• https://doc.powerdns.com/md/security/powerdns-advisory-2016-01/
• https://www.powerdns.com/