CVE-2017-15120 : What You Need to Know

A vulnerability has been discovered in PowerDNS Recursor prior to version 4.0.8, allowing for a denial of service attack through a manipulated answer containing a CNAME with a different class from IN.

Understanding CVE-2017-15120

This CVE involves a flaw in the parsing of authoritative answers in PowerDNS Recursor, potentially leading to a NULL pointer dereference.

What is CVE-2017-15120?

The vulnerability in PowerDNS Recursor before version 4.0.8 allows an unauthenticated attacker to trigger a denial of service by exploiting a specific parsing issue in authoritative answers.

The Impact of CVE-2017-15120

CVSS Base Score: 7.5 (High)
Attack Vector: Network
Attack Complexity: Low
Availability Impact: High
This vulnerability could result in a NULL pointer dereference, leading to a denial of service condition.

Technical Details of CVE-2017-15120

This section provides more in-depth technical insights into the CVE.

Vulnerability Description

The vulnerability arises from the incorrect parsing of authoritative answers in PowerDNS Recursor, specifically when encountering a manipulated answer with a CNAME of a different class than IN.

Affected Systems and Versions

Affected Product: pdns-recursor
Vendor: PowerDNS
Affected Version: 4.0.8

Exploitation Mechanism

An attacker can exploit this vulnerability by sending a specially crafted answer containing a CNAME with a class different from IN, triggering a NULL pointer dereference and causing a denial of service.

Mitigation and Prevention

Protecting systems from CVE-2017-15120 requires immediate actions and long-term security measures.

Immediate Steps to Take

Update PowerDNS Recursor to version 4.0.8 or newer to mitigate the vulnerability.
Monitor network traffic for any signs of exploitation.

Long-Term Security Practices

Regularly update and patch software to prevent known vulnerabilities.
Implement network segmentation to limit the impact of potential attacks.
Conduct regular security assessments and audits to identify and address security weaknesses.

Patching and Updates

Apply patches and updates provided by PowerDNS to address the vulnerability and enhance system security.