Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1193 to the following vulnerability: The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. References: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1193 [2] https://www.isc.org/files/imce/ghostdomain_camera.pdf Upstream patch: There doesn't seem to be upstream patch available yet. Please further cooperate with upstream to get one.
This issue affects the versions of the pdns-recursor package, as shipped with Fedora release of 15 and 16. Please schedule an update once final upstream patch ready. -- This issue affects the versions of the pdns-recursor package, as shipped with Fedora EPEL 4, 5, and 6. Please schedule an update once final upstream patch ready.
Created pdns-recursor tracking bugs for this issue Affects: fedora-all [bug 794965] Affects: epel-all [bug 794966]
There's still no patch available. I'm going to build updated packages as soon as a patch is available.
From http://doc.powerdns.com/changelog.html#changelog-recursor-3.5: "While Recursor 3.3 was not vulnerable to the specific attack noted in 'Ghost Domain Names: Revoked Yet Still Resolvable', further investigation showed that a variant of the attack could work. This was fixed in r3085." http://wiki.powerdns.com/trac/changeset/3085 related: http://wiki.powerdns.com/trac/changeset/3084 http://wiki.powerdns.com/trac/changeset/3083 http://wiki.powerdns.com/trac/changeset/3082 There's also the following upstream bug: http://wiki.powerdns.com/trac/ticket/668
pdns-recursor-3.5-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
Security updates available: Fedora: pdns-recursor-3.5-2.fc17 pdns-recursor-3.5-2.fc18 pdns-recursor-3.5-2.fc19 pdns-recursor-3.5-2.fc20 Fedora EPEL: pdns-recursor-3.5-1.el5 pdns-recursor-3.5-1.el6
FYI Upstream changelog says version 3.3 was not vulnerable: "While Recursor 3.3 was not vulnerable to the specific attack noted in 'Ghost Domain Names: Revoked Yet Still Resolvable', further investigation showed that a variant of the attack could work. This was fixed in commit 3085. This should also close the slightly bogus CVE-2012-1193. Closes ticket 668."