Bug 1257229 (CVE-2015-5230) - CVE-2015-5230 pdns: denial of service due to memory leak in exception handling routines
Summary: CVE-2015-5230 pdns: denial of service due to memory leak in exception handlin...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-5230
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1259603
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-08-26 14:37 UTC by Vasyl Kaigorodov
Modified: 2021-10-21 00:46 UTC (History)
1 user (show)

Fixed In Version: PowerDNS 3.4.6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-21 00:46:20 UTC
Embargoed:

Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-08-26 14:37:48 UTC 
Upstream reports a bug in PowerDNS DNS packet parsing/generation code,
which, when exploited, can cause a crash of individual threads (disabling service)
or crash of whole processes (allowing a supervisor to restart them) with
just one or a few query packets.

PowerDNS Authoritative Server 3.4.0-3.4.5 are affected. No other
versions are affected. The PowerDNS Recursor is not affected.

Upstream patches:
https://github.com/PowerDNS/pdns/commit/c849701f7be442b21db69366d00cd92b64d660cd
https://github.com/PowerDNS/pdns/commit/8c91e2ccd0c775405b3c3dc0cb576106924ae364
Comment 1 Martin Prpič 2015-09-03 07:16:06 UTC 
Public via:

http://seclists.org/oss-sec/2015/q3/476
Comment 2 Martin Prpič 2015-09-03 07:16:34 UTC 
Created pdns tracking bugs for this issue:

Affects: fedora-all [bug 1259603]
Comment 3 Martin Prpič 2015-09-03 07:17:09 UTC 
Patches from the advisory:

https://downloads.powerdns.com/patches/2015-02/
Comment 4 Fedora Update System 2015-09-26 17:34:28 UTC 
pdns-3.4.6-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2015-09-27 03:23:04 UTC 
pdns-3.4.6-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2015-09-27 18:22:08 UTC 
pdns-3.4.6-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.