Mageia alert MGASA-2017-0036 (pdns-recursor)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2017-0036: Updated pdns-recursor packages fix security vulnerability 
Date:
    	     
 
Thu, 2 Feb 2017 20:17:47 +0100
Message-ID:
    	     
 
<20170202191747.7496C9F7CC@duvel.mageia.org>
MGASA-2017-0036 - Updated pdns-recursor packages fix security vulnerability

Publication date: 02 Feb 2017
URL: http://advisories.mageia.org/MGASA-2017-0036.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-7068

Description:
Florian Heinz and Martin Kluge reported that pdns-recursor parses all
records present in a query regardless of whether they are needed or even
legitimate, allowing a remote, unauthenticated attacker to cause an
abnormal CPU usage load on the pdns server, resulting in a partial
denial of service if the system becomes overloaded (CVE-2016-7068).

References:
- https://bugs.mageia.org/show_bug.cgi?id=20127
- https://doc.powerdns.com/md/security/powerdns-advisory-20...
- https://www.debian.org/security/2017/dsa-3763
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7068

SRPMS:
- 5/core/pdns-recursor-3.6.4-1.1.mga5