pdns-recursor

Page content
  • Author: vmiklos
  • Vulnerable: 3.1.4-3
  • Unaffected: 3.1.5-1kalgan1

Amit Klein has reported a vulnerability in PowerDNS Recursor, which can be exploited by malicious people to poison the DNS cache. The vulnerability is caused due to the application using predictable standard C library functions to generate random numbers (e.g. “rand()” and “srand()”), which are then used to create the transaction ID (TRXID) and UDP source port. This can be exploited to poison the DNS cache by guessing the transaction TRXID and the UDP source port.

CVEs: