Bug 1483867 (CVE-2017-7557)

Summary:	CVE-2017-7557 dnsdist: Alteration of ACLs via API authentication bypass
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ruben, sander
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dnsdist 1.2.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:21:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1483872, 1483873
Bug Blocks:

Description Adam Mariš 2017-08-22 07:33:01 UTC

An issue has been found in dnsdist 1.1.0, in the API authentication mechanism. API methods should only be available to a user authenticated via an X-API-Key HTTP header, and not to a user authenticated on the webserver via Basic Authentication, but it was discovered by Nixu during a source code audit that dnsdist 1.1.0 allows access to all API methods to both kind of users.

In the default configuration, the API does not provide access to more information than the webserver does, and therefore this issue has no security implication. However if the API is allowed to make configuration changes, via the setAPIWritable(true) option, this allows a remote unauthenticated user to trick an authenticated user into editing dnsdist’s ACLs by making him visit a crafted website containing a Cross-Site Request Forgery.

Reference:

https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2017-02.html

Comment 1 Adam Mariš 2017-08-22 07:33:10 UTC

Acknowledgments:

Name: the PowerDNS project
Upstream: Nixu

Comment 2 Adam Mariš 2017-08-22 07:39:20 UTC

Created dnsdist tracking bugs for this issue:

Affects: epel-7 [bug 1483873]
Affects: fedora-all [bug 1483872]

Comment 3 Product Security DevOps Team 2019-06-08 03:21:53 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.