{"id":95506,"date":"2020-09-30T13:42:15","date_gmt":"2020-09-30T11:42:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-powerdns-authoritative-server"},"modified":"2020-09-30T13:42:15","modified_gmt":"2020-09-30T11:42:15","slug":"uyazvimosti-v-powerdns-authoritative-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimosti-v-powerdns-authoritative-server","title":{"rendered":"Schw\u00e4chen im PowerDNS Authoritative Server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/blog.powerdns.com\/2020\/09\/22\/powerdns-authoritative-4-3-1-4-2-3-and-4-1-14\/\">Pr\u00e4sentationen<\/a><\/noindex> Aktualisierungen des autoritativen DNS-Servers <noindex><a rel=\"nofollow\" href=\"https:\/\/www.powerdns.com\/\">PowerDNS Authoritative Server 4.3.1, 4.2.3 und 4.1.14<\/a><\/noindex>, in denen <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/09\/22\/11\">behebt<\/a><\/noindex> vier Schwachstellen auftreten, von denen zwei potenziell zu einer Remote-Codeausf\u00fchrung durch einen Angreifer f\u00fchren k\u00f6nnen.<\/p>\n<p>Die Schwachstellen CVE-2020-24696, CVE-2020-24697 und CVE-2020-24698<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/docs.powerdns.com\/authoritative\/security-advisories\/powerdns-advisory-2020-06.html\">betreffen<\/a><\/noindex> Code zur Implementierung des Schl\u00fcsseltauschmechanismus <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Generic_Security_Service_Algorithm_for_Secret_Key_Transaction\">GSS-TSIG<\/a><\/noindex>. Schwachstellen treten nur auf, wenn PowerDNS mit Unterst\u00fctzung f\u00fcr GSS-TSIG (-enable-experimental-gss-tsig, standardm\u00e4\u00dfig nicht aktiviert) kompiliert wird und k\u00f6nnen durch das Senden eines speziell gestalteten Netzwerkpakets ausgenutzt werden. Die Schwachstellen CVE-2020-24696 und CVE-2020-24698, die durch einen Wettlaufzustand und doppelte Freigabe von Speicher (double-free) verursacht werden, k\u00f6nnen zum Absturz oder zur Ausf\u00fchrung von Angreifercode beim Verarbeiten von Anfragen mit fehlerhaft formatierten GSS-TSIG-Signaturen f\u00fchren. Die Schwachstelle CVE-2020-24697 beschr\u00e4nkt sich auf einen Denial-of-Service. Da der GSS-TSIG-Code standardm\u00e4\u00dfig nicht verwendet wurde, auch nicht in den Paketen der Distributionen, und m\u00f6glicherweise andere Probleme enth\u00e4lt, wurde beschlossen, ihn vollst\u00e4ndig aus der Ver\u00f6ffentlichung von PowerDNS Authoritative 4.4.0 zu entfernen.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/docs.powerdns.com\/authoritative\/security-advisories\/powerdns-advisory-2020-05.html\">CVE-2020-17482<\/a><\/noindex> kann zu Informationen aus nicht initialisiertem Speicher des Prozesses f\u00fchren, tritt jedoch nur bei der Verarbeitung von Anfragen von authentifizierten Benutzern auf, die die M\u00f6glichkeit haben, neue Eintr\u00e4ge in die vom DNS-Server verwalteten Zonen hinzuzuf\u00fcgen.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Quelle: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53806\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u0433\u043e (authoritative) DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 PowerDNS Authoritative Server 4.3.1, 4.2.3 \u0438 4.1.14, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-24696, CVE-2020-24697 \u0438 CVE-2020-24698 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u043a\u043e\u0434 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 GSS-TSIG. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 PowerDNS c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 GSS-TSIG (&#171;&#8212;enable-experimental-gss-tsig&#187;, \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f) [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95506","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u0433\u043e (authoritative) DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimosti-v-powerdns-authoritative-server\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"de_DE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 PowerDNS Authoritative Server | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u0433\u043e (authoritative) DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimosti-v-powerdns-authoritative-server\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-30T11:42:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-30T11:42:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Schwachstellen im PowerDNS Authoritative Server | ProHoster","description":"Aktualisierungen des autoritativen DNS-Servers sind verf\u00fcgbar","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimosti-v-powerdns-authoritative-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 PowerDNS Authoritative Server | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u0433\u043e (authoritative) DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimosti-v-powerdns-authoritative-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-30T11:42:15+00:00","article:modified_time":"2020-09-30T11:42:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95506","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:04:40","updated":"2022-10-03 07:45:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/95506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=95506"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/95506\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=95506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=95506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=95506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}