SB2019020605 - OpenSUSE Linux update for pdns-recursor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019020605

SB2019020605 - OpenSUSE Linux update for pdns-recursor

Published: February 6, 2019

Security Bulletin ID SB2019020605
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security restrictions bypass (CVE-ID: CVE-2019-3806)

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to Lua hooks are not properly applied to queries received over TCP in some specific combination of settings. A remote attacker can bypass security policies enforced using Lua.


2) Security restrictions bypass (CVE-ID: CVE-2019-3807)

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated. A remote attacker can bypass DNSSEC validation.


Remediation

Install update from vendor's website.

References