Bug 794963 (CVE-2012-1193)

Summary:	CVE-2012-1193 pdns-recursor: Deleted / ghost domain names resolving flaw
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ms, ruben, zaphodb
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-05-01 08:33:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	794965, 794966
Bug Blocks:

Description Jan Lieskovsky 2012-02-18 10:33:49 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1193 to the following vulnerability:

The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1193
[2] https://www.isc.org/files/imce/ghostdomain_camera.pdf

Upstream patch:
There doesn't seem to be upstream patch available yet. Please further cooperate with upstream to get one.

Comment 1 Jan Lieskovsky 2012-02-18 10:35:39 UTC

This issue affects the versions of the pdns-recursor package, as shipped with Fedora release of 15 and 16. Please schedule an update once final upstream patch ready.

--

This issue affects the versions of the pdns-recursor package, as shipped with Fedora EPEL 4, 5, and 6. Please schedule an update once final upstream patch ready.

Comment 2 Jan Lieskovsky 2012-02-18 10:37:17 UTC

Created pdns-recursor tracking bugs for this issue

Affects: fedora-all [bug 794965]
Affects: epel-all [bug 794966]

Comment 3 Morten Stevens 2012-09-26 14:39:46 UTC

There's still no patch available.

I'm going to build updated packages as soon as a patch is available.

Comment 4 Stefan Cornelius 2013-02-27 08:42:25 UTC

From http://doc.powerdns.com/changelog.html#changelog-recursor-3.5:
"While Recursor 3.3 was not vulnerable to the specific attack noted in 'Ghost Domain Names: Revoked Yet Still Resolvable', further investigation showed that a variant of the attack could work. This was fixed in r3085."

http://wiki.powerdns.com/trac/changeset/3085

related:
http://wiki.powerdns.com/trac/changeset/3084
http://wiki.powerdns.com/trac/changeset/3083
http://wiki.powerdns.com/trac/changeset/3082


There's also the following upstream bug:
http://wiki.powerdns.com/trac/ticket/668

Comment 5 Fedora Update System 2013-04-20 19:47:56 UTC

pdns-recursor-3.5-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Morten Stevens 2013-05-01 08:33:18 UTC

Security updates available:

Fedora:

pdns-recursor-3.5-2.fc17
pdns-recursor-3.5-2.fc18
pdns-recursor-3.5-2.fc19
pdns-recursor-3.5-2.fc20

Fedora EPEL:

pdns-recursor-3.5-1.el5
pdns-recursor-3.5-1.el6

Comment 7 Stefan Schmidt 2013-05-02 11:51:48 UTC

FYI Upstream changelog says version 3.3 was not vulnerable:

"While Recursor 3.3 was not vulnerable to the specific attack noted in 'Ghost Domain Names: Revoked Yet Still Resolvable', further investigation showed that a variant of the attack could work. This was fixed in commit 3085. This should also close the slightly bogus CVE-2012-1193. Closes ticket 668."