Bug 794963 (CVE-2012-1193) - CVE-2012-1193 pdns-recursor: Deleted / ghost domain names resolving flaw
Summary: CVE-2012-1193 pdns-recursor: Deleted / ghost domain names resolving flaw
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2012-1193
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 794965 794966
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-02-18 10:33 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:50 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-05-01 08:33:18 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2012-02-18 10:33:49 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1193 to the following vulnerability:

The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1193
[2] https://www.isc.org/files/imce/ghostdomain_camera.pdf

Upstream patch:
There doesn't seem to be upstream patch available yet. Please further cooperate with upstream to get one.

Comment 1 Jan Lieskovsky 2012-02-18 10:35:39 UTC
This issue affects the versions of the pdns-recursor package, as shipped with Fedora release of 15 and 16. Please schedule an update once final upstream patch ready.

--

This issue affects the versions of the pdns-recursor package, as shipped with Fedora EPEL 4, 5, and 6. Please schedule an update once final upstream patch ready.

Comment 2 Jan Lieskovsky 2012-02-18 10:37:17 UTC
Created pdns-recursor tracking bugs for this issue

Affects: fedora-all [bug 794965]
Affects: epel-all [bug 794966]

Comment 3 Morten Stevens 2012-09-26 14:39:46 UTC
There's still no patch available.

I'm going to build updated packages as soon as a patch is available.

Comment 4 Stefan Cornelius 2013-02-27 08:42:25 UTC
From http://doc.powerdns.com/changelog.html#changelog-recursor-3.5:
"While Recursor 3.3 was not vulnerable to the specific attack noted in 'Ghost Domain Names: Revoked Yet Still Resolvable', further investigation showed that a variant of the attack could work. This was fixed in r3085."

http://wiki.powerdns.com/trac/changeset/3085

related:
http://wiki.powerdns.com/trac/changeset/3084
http://wiki.powerdns.com/trac/changeset/3083
http://wiki.powerdns.com/trac/changeset/3082


There's also the following upstream bug:
http://wiki.powerdns.com/trac/ticket/668

Comment 5 Fedora Update System 2013-04-20 19:47:56 UTC
pdns-recursor-3.5-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Morten Stevens 2013-05-01 08:33:18 UTC
Security updates available:

Fedora:

pdns-recursor-3.5-2.fc17
pdns-recursor-3.5-2.fc18
pdns-recursor-3.5-2.fc19
pdns-recursor-3.5-2.fc20

Fedora EPEL:

pdns-recursor-3.5-1.el5
pdns-recursor-3.5-1.el6

Comment 7 Stefan Schmidt 2013-05-02 11:51:48 UTC
FYI Upstream changelog says version 3.3 was not vulnerable:

"While Recursor 3.3 was not vulnerable to the specific attack noted in 'Ghost Domain Names: Revoked Yet Still Resolvable', further investigation showed that a variant of the attack could work. This was fixed in commit 3085. This should also close the slightly bogus CVE-2012-1193. Closes ticket 668."


Note You need to log in before you can comment on or make changes to this bug.