PowerDNS DNSdist Out-of-Bounds Write Vulnerability Leading to Denial-of-Service

A vulnerability allowing an out-of-bounds write has been identified in PowerDNS DNSdist versions 1.9.0 prior to 1.9.11 and 2.0.0 prior to 2.0.2. This vulnerability can be exploited by sending crafted DNS responses that manipulate the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. The exploitation may cause the modified packet to exceed the maximum DNS packet size, leading to a crash and a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a crash of the DNSdist process, leading to a denial-of-service condition.

Remediation

Users can upgrade to PowerDNS DNSdist versions 1.9.12 or 2.0.3, where this vulnerability has been patched. Alternatively, the vulnerable methods can be avoided in custom Lua code.