CVE-2017-15090 : What You Need to Know

PowerDNS Recursor versions 4.0.0 to 4.0.6 are affected by a DNSSEC validation issue that could allow an attacker to manipulate records by producing valid signatures for altered data.

Understanding CVE-2017-15090

This CVE involves a vulnerability in the DNSSEC validation feature of PowerDNS Recursor versions 4.0.0 to 4.0.6, potentially enabling unauthorized modification of DNS records.

What is CVE-2017-15090?

The problem lies in the validation of DNSSEC signatures, where data outside the scope of the DNSKEY used for signing can be considered valid, allowing for record manipulation by an attacker intercepting communications.

The Impact of CVE-2017-15090

The vulnerability could lead to unauthorized alteration of DNS records by exploiting the flawed DNSSEC validation process, compromising the integrity and authenticity of the data.

Technical Details of CVE-2017-15090

PowerDNS Recursor versions 4.0.0 to 4.0.6 are susceptible to a DNSSEC validation flaw that permits the acceptance of invalid signatures under certain conditions.

Vulnerability Description

The issue allows for the acceptance of signatures as valid even when the signed data is not within the expected scope of the DNSKEY used for signing, enabling malicious content manipulation.

Affected Systems and Versions

Product: PowerDNS
Vendor: PowerDNS
Versions Affected: 4.0.0 to 4.0.6

Exploitation Mechanism

Attackers intercepting communications can exploit the vulnerability to produce valid signatures for manipulated records, enabling unauthorized content modification.

Mitigation and Prevention

Immediate Steps to Take:

Update PowerDNS Recursor to a non-vulnerable version.
Monitor DNS traffic for any suspicious activities. Long-Term Security Practices:
Implement DNSSEC best practices to enhance data integrity.
Regularly audit and review DNS configurations for potential vulnerabilities. Patch and Updates:
Apply patches provided by PowerDNS to address the DNSSEC validation issue and prevent unauthorized record alterations.