[Pdns-users] Security update: PowerDNS Authoritative Server 220.127.116.11 released
bert.hubert at netherlabs.nl
Wed Aug 6 18:00:06 UTC 2008
Released on the 6th of August 2008.
* All UNIX/Linux distributions shipping PowerDNS have been notified and are
working on updating their packages
This release consists of a single patch to PowerDNS Authoritative Server
version 2.9.21. Brian J. Dowling of Simplicity Communications has
discovered a security implication of the previous PowerDNS behaviour to
drop queries it considers malformed. We are grateful that Brian notified
us quickly about this problem.
This issue has been assigned CVE-2008-3337. The single patch is in commit
More detail can be found in http://doc.powerdns.com/powerdns-advisory-2008-02.html
The implication is that while the PowerDNS Authoritative server itself
does not face a security risk because of dropping these malformed queries,
other resolving nameservers run a higher risk of accepting spoofed answers
for domains being hosted by PowerDNS Authoritative Servers before
While the dropping of queries does not aid sophisticated spoofing
attempts, it does facilitate simpler attacks.
It may be good to know that several large sites already run with this
patch applied, as it has been in the public codebase for some weeks
http://www.PowerDNS.com Open source, database driven DNS Software
http://netherlabs.nl Open and Closed source services
More information about the Pdns-users