CVE-2020-24698 : Security Advisory and Response

PowerDNS Authoritative through 4.3.0 is affected by a vulnerability when using --enable-experimental-gss-tsig, allowing a remote attacker to execute arbitrary code.

Understanding CVE-2020-24698

An issue in PowerDNS Authoritative through version 4.3.0 could lead to a crash or potential code execution.

What is CVE-2020-24698?

This CVE identifies a vulnerability in PowerDNS Authoritative that could be exploited by an unauthenticated remote attacker.

The Impact of CVE-2020-24698

The vulnerability could result in a double-free scenario, potentially leading to a system crash or the execution of arbitrary code by sending specially crafted queries.

Technical Details of CVE-2020-24698

PowerDNS Authoritative through version 4.3.0 is susceptible to exploitation.

Vulnerability Description

The issue arises when --enable-experimental-gss-tsig is enabled, allowing remote attackers to trigger a double-free condition.

Affected Systems and Versions

Product: PowerDNS Authoritative
Vendor: PowerDNS
Versions: All versions up to 4.3.0

Exploitation Mechanism

Attackers can exploit this vulnerability by sending malicious queries with a GSS-TSIG signature.

Mitigation and Prevention

Steps to address and prevent exploitation of CVE-2020-24698.

Immediate Steps to Take

Disable --enable-experimental-gss-tsig if not required
Monitor for any unusual query patterns

Long-Term Security Practices

Regularly update PowerDNS Authoritative to the latest version
Implement network segmentation and access controls

Patching and Updates

Apply patches provided by PowerDNS to address this vulnerability