PowerDNS Security Advisory 2017-07: Memory leak in DNSSEC parsing

  • CVE: CVE-2017-15094

  • Date: November 27th 2017

  • Credit: Nixu

  • Affects: PowerDNS Recursor from 4.0.0 up to and including 4.0.6

  • Not affected: PowerDNS Recursor 4.0.7

  • Severity: Medium

  • Impact: Denial of service

  • Exploit: This problem can be triggered by an authoritative server sending crafted ECDSA DNSSEC keys to the Recursor.

  • Risk of system compromise: No

  • Solution: Upgrade to a non-affected version

  • Workaround: Disable DNSSEC validation by setting the dnssec parameter to off or process-no-validate (default).

An issue has been found in the DNSSEC parsing code of PowerDNS Recursor during a code audit by Nixu, leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default). This issue has been assigned CVE-2017-15094.

PowerDNS Recursor from 4.0.0 up to and including 4.0.6 are affected.

For those unable to upgrade to a new version, a minimal patch is available

We would like to thank Nixu for finding and subsequently reporting this issue.