PowerDNS Recursor Crafted Zone Traffic Increase Vulnerability

A denial-of-service vulnerability has been identified in PowerDNS Recursor versions up to and including 5.1.9, 5.2.7, and 5.3.4. The issue arises from the handling of crafted zones, which can lead to increased incoming network traffic, causing a strain on resources.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, where the increased network traffic disrupts normal operations and resource availability.

Reproduction

The vulnerability can be reproduced by publishing a crafted DNS zone that is designed to generate excessive incoming network traffic when queried. This can be done by manipulating the zone data to create a higher volume of queries or responses that the server must process, thereby increasing resource usage and network load.

Remediation

Users are advised to upgrade to PowerDNS Recursor versions 5.1.10, 5.2.8, or 5.3.5, which contain the necessary patches to address this vulnerability.