<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>9. PowerDNS Security Advisory 2008-02: Some PowerDNS Configurations can be forced to restart remotely</title><link rel="stylesheet" href="docbook.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /><link rel="home" href="index.html" title="PowerDNS manual" /><link rel="up" href="powerdns.html" title="Chapter 1. The PowerDNS dynamic nameserver" /><link rel="prev" href="powerdns-advisory-2008-02.html" title="8. PowerDNS Security Advisory 2008-02: By not responding to certain queries, domains become easier to spoof" /><link rel="next" href="powerdns-advisory-2010-01.html" title="10. PowerDNS Security Advisory 2010-01: PowerDNS Recursor up to and including 3.1.7.1 can be brought down and probably exploited" /></head><body><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">9. PowerDNS Security Advisory 2008-02: Some PowerDNS Configurations can be forced to restart remotely</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="powerdns-advisory-2008-02.html">Prev</a> </td><th width="60%" align="center">Chapter 1. The PowerDNS dynamic nameserver</th><td width="20%" align="right"> <a accesskey="n" href="powerdns-advisory-2010-01.html">Next</a></td></tr></table><hr /></div><div class="sect1" title="9. PowerDNS Security Advisory 2008-02: Some PowerDNS Configurations can be forced to restart remotely"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="powerdns-advisory-2008-03"></a>9. PowerDNS Security Advisory 2008-02: Some PowerDNS Configurations can be forced to restart remotely</h2></div></div></div><p>
</p><div class="table"><a id="idp7667728"></a><p class="title"><b>Table 1.5. PowerDNS Security Advisory</b></p><div class="table-contents"><table summary="PowerDNS Security Advisory" border="1"><colgroup><col /><col /></colgroup><tbody><tr><td>
CVE
</td><td>
Not yet assigned
</td></tr><tr><td>
Date
</td><td>
18th of November 2008
</td></tr><tr><td>
Affects
</td><td>
PowerDNS Authoritative Server 2.9.21.1 and earlier
</td></tr><tr><td>
Not affected
</td><td>
No versions of the PowerDNS Recursor ('pdns_recursor') are affected. Versions not running in single threaded mode ('distributor-threads=1') are probably not affected.
</td></tr><tr><td>
Severity
</td><td>
Moderate
</td></tr><tr><td>
Impact
</td><td>
Denial of Service
</td></tr><tr><td>
Exploit
</td><td>
Send PowerDNS an CH HINFO query.
</td></tr><tr><td>
Solution
</td><td>
Upgrade to PowerDNS Authoritative Server 2.9.21.2, or wait for 2.9.22.
</td></tr><tr><td>
Workaround
</td><td>
Remove 'distributor-threads=1' if this is set.
</td></tr></tbody></table></div></div><p><br class="table-break" />
</p><p>
Daniel Drown discovered that his PowerDNS 2.9.21.1 installation crashed on receiving a HINFO CH query. In his enthousiasm, he shared
his discovery with the world, forcing a rapid over the weekend release cycle.
</p><p>
While we thank Daniel for his discovery, please study our security policy as outlined in <a class="xref" href="security-policy.html" title="4. Security">Section 4, “Security”</a> before making vulnerabilities public.
</p><p>
It is believed that this issue only impacts PowerDNS Authoritative Servers operating with 'distributor-threads=1', but even on other configurations a database reconnect
occurs on receiving a CH HINFO query.
</p></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="powerdns-advisory-2008-02.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="powerdns.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="powerdns-advisory-2010-01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">8. PowerDNS Security Advisory 2008-02: By not responding to certain queries, domains become easier to spoof </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> 10. PowerDNS Security Advisory 2010-01: PowerDNS Recursor up to and including 3.1.7.1 can be brought down and probably exploited</td></tr></table></div></body></html>
