SB2018121202 - OpenSUSE Linux update for pdns 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018121202

SB2018121202 - OpenSUSE Linux update for pdns

Published: December 12, 2018

Security Bulletin ID SB2018121202
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Memory leak (CVE-ID: CVE-2018-10851)

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The vulnerability exists due to memory leak when handling malicious input. A remote attacker can insert a specially crafted record in a zone under his control, send a DNS query for that record, trigger memory leak and cause the service to crash.


2) Improper input validation (CVE-ID: CVE-2018-14626)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to DNSSEC validating clients consider the answer to be bogus until it expires from the packet cache. A remote attacker can craft a DNS query, cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype.


Remediation

Install update from vendor's website.

References