Input validation error in pdns (Alpine package)

1) Input validation error

EUVDB-ID: #VU18151

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2019-3871

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing DNS requests in RESTful mode in the HTTP Connector of the Remote backend. A remote attacker can send a specially crafted DNS request to the affected server and perform denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

pdns (Alpine package): 4.0.3-r0 - 4.1.5-r0

CPE2.3

• cpe:2.3:o:alpine:pdns_alpine_package:4.0.3-r0:*:*:*:*:alpine_linux:*:3.4
• cpe:2.3:o:alpine:pdns_alpine_package:4.0.3-r2:*:*:*:*:alpine_linux:*:3.5
• cpe:2.3:o:alpine:pdns_alpine_package:4.0.5-r0:*:*:*:*:alpine_linux:*:3.6

External links

https://git.alpinelinux.org/aports/commit/?id=b8d81030dc9fbd092647bd1c73901b0c7cbcfb41
https://git.alpinelinux.org/aports/commit/?id=333ed82593af01cf2a74180b9214c59528fb1e11
https://git.alpinelinux.org/aports/commit/?id=0ef8821508fe2042c199551d43e728d1af2cde36
https://git.alpinelinux.org/aports/commit/?id=c27a9a0149a05ea96879173e9c2275e97c789d00
https://git.alpinelinux.org/aports/commit/?id=1bf6e4dfc6f744c7ba0a8e37cbe4a670a88489f8
https://git.alpinelinux.org/aports/commit/?id=7296a289a69c4f85ce77dcde7915f59f071debf2
https://git.alpinelinux.org/aports/commit/?id=a5a93e4963f1fa85d07871cbb586e952309b46b5

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.