Bug 794963 - (CVE-2012-1193) CVE-2012-1193 pdns-recursor: Deleted / ghost domain names resolving flaw
CVE-2012-1193 pdns-recursor: Deleted / ghost domain names resolving flaw
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120207,repor...
: Security
Depends On: 794965 794966
Blocks:
  Show dependency treegraph
 
Reported: 2012-02-18 05:33 EST by Jan Lieskovsky
Modified: 2013-05-02 07:51 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-05-01 04:33:18 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-02-18 05:33:49 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1193 to the following vulnerability:

The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1193
[2] https://www.isc.org/files/imce/ghostdomain_camera.pdf

Upstream patch:
There doesn't seem to be upstream patch available yet. Please further cooperate with upstream to get one.
Comment 1 Jan Lieskovsky 2012-02-18 05:35:39 EST
This issue affects the versions of the pdns-recursor package, as shipped with Fedora release of 15 and 16. Please schedule an update once final upstream patch ready.

--

This issue affects the versions of the pdns-recursor package, as shipped with Fedora EPEL 4, 5, and 6. Please schedule an update once final upstream patch ready.
Comment 2 Jan Lieskovsky 2012-02-18 05:37:17 EST
Created pdns-recursor tracking bugs for this issue

Affects: fedora-all [bug 794965]
Affects: epel-all [bug 794966]
Comment 3 Morten Stevens 2012-09-26 10:39:46 EDT
There's still no patch available.

I'm going to build updated packages as soon as a patch is available.
Comment 4 Stefan Cornelius 2013-02-27 03:42:25 EST
From http://doc.powerdns.com/changelog.html#changelog-recursor-3.5:
"While Recursor 3.3 was not vulnerable to the specific attack noted in 'Ghost Domain Names: Revoked Yet Still Resolvable', further investigation showed that a variant of the attack could work. This was fixed in r3085."

http://wiki.powerdns.com/trac/changeset/3085

related:
http://wiki.powerdns.com/trac/changeset/3084
http://wiki.powerdns.com/trac/changeset/3083
http://wiki.powerdns.com/trac/changeset/3082


There's also the following upstream bug:
http://wiki.powerdns.com/trac/ticket/668
Comment 5 Fedora Update System 2013-04-20 15:47:56 EDT
pdns-recursor-3.5-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Morten Stevens 2013-05-01 04:33:18 EDT
Security updates available:

Fedora:

pdns-recursor-3.5-2.fc17
pdns-recursor-3.5-2.fc18
pdns-recursor-3.5-2.fc19
pdns-recursor-3.5-2.fc20

Fedora EPEL:

pdns-recursor-3.5-1.el5
pdns-recursor-3.5-1.el6
Comment 7 Stefan Schmidt 2013-05-02 07:51:48 EDT
FYI Upstream changelog says version 3.3 was not vulnerable:

"While Recursor 3.3 was not vulnerable to the specific attack noted in 'Ghost Domain Names: Revoked Yet Still Resolvable', further investigation showed that a variant of the attack could work. This was fixed in commit 3085. This should also close the slightly bogus CVE-2012-1193. Closes ticket 668."

Note You need to log in before you can comment on or make changes to this bug.