CVE-2018-1046

pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.

A stack-based buffer overflow in the dnsreplay tool occurring when replaying a specially crafted PCAP file with the --ecs-stamp option enabled, leading to a denial of service or potentially arbitrary code execution (CVE-2018-1046).

pdns was updated to 4.1.2.

Security fixes:

• Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046 bsc#1092540)

Improvements:

• API: increase serial after dnssec related updates
• Auth: lower ‘packet too short’ loglevel
• Make check-zone error on rows that have content but shouldn’t
• Auth: avoid an isane amount of new backend connections during an axfr
• Report unparseable data in stoul invalid_argument exception
• Backport: recheck serial when axfr is done
• Backport: add tcp support for alias

Bug Fixes:

• Auth: allocate new statements after reconnecting to postgresql
• Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer)
• Rather than crash, sheepishly report no file/linenum
• Document undocumented config vars
• Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate

Misc fixes:

• Move includes around to avoid boost L conflict
• Backport: update edns option code list
• Auth: link dnspcap2protobuf against librt when needed
• Fix a warning on botan >= 2.5.0
• Auth 4.1.x: unbreak build

These are all security issues fixed in the pdns-4.5.1-1.5 package on the GA media of openSUSE Tumbleweed.

This update for pdns fixes the following issues:

Security issues fixed:

• CVE-2018-1046: Fix an issue with replaying a specially crafted PCAP file that can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution (bsc#1092540).

Wei Hao discovered that PowerDNS Authoritative Server incorrectly handled memory when accessing certain files. An attacker could possibly use this issue to achieve arbitrary code execution. (CVE-2018-1046)

It was discovered that PowerDNS Authoritative Server and PowerDNS Recursor incorrectly handled memory when receiving certain remote input. An attacker could possibly use this issue to cause denial of service. (CVE-2018-10851)

Kees Monshouwer discovered that PowerDNS Authoritative Server and PowerDNS Recursor incorrectly handled request validation after having cached malformed input. An attacker could possibly use this issue to cause denial of service. (CVE-2018-14626)

Toshifumi Sakaguchi discovered that PowerDNS Recursor incorrectly handled requests after having cached malformed input. An attacker could possibly use this issue to cause denial of service. (CVE-2018-14644)

Nathaniel Ferguson discovered that PowerDNS Authoritative Server incorrectly handled memory when receiving certain remote input. An attacker could possibly use this issue to obtain sensitive information. (CVE-2020-17482)

Nicolas Dehaine and Dmitry Shabanov discovered that PowerDNS Authoritative Server and PowerDNS Recursor incorrectly handled IXFR requests in certain circumstances. An attacker could possibly use this issue to cause denial of service. (CVE-2022-27227)