CVE-2018-1000003

Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.

An issue has been found in the DNSSEC validation component of PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3 record to be used to wrongfully prove the non-existence of a RR below the owner name of that record. This would allow an attacker in position of man-in-the-middle to send a NXDOMAIN answer for a name that does exist (CVE-2018-1000003).

This update for pdns-recursor fixes the following issues:

• update to 4.1.2

  • New Features
    • #6344: Add FFI version of gettag().
  • Improvements
    • #6298, #6303, #6268, #6290: Add the option to set the AXFR timeout for RPZs.
    • #6172: IXFR: correct behavior of dealing with DNS Name with multiple records and speed up IXFR transaction (Leon Xu).
    • #6379: Add RPZ statistics endpoint to the API.
  • Bug Fixes
    • #6336, #6293, #6237: Retry loading RPZ zones from server when they fail initially.
    • #6300: Fix ECS-based cache entry refresh code.
    • #6320: Fix ECS-specific NS AAAA not being returned from the cache.

• update to version 4.1.1:

  • Fixes security vulnerability where man-in-the-middle to send a NXDOMAIN answer for a DNSSEC name that does exist. (boo#1077154, CVE-2018-1000003)
  • Don't validate signature for 'glue' CNAME, since anything else than the initial CNAME can’t be considered authoritative.

• update to version 4.0.7: (boo#1069242)

These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.