Merge pull request #4900 from pieterlexis/docs-3X-january-2017

Auth 3.4.11 and recursor 3.7.4 changelogs

docs/markdown/changelog.md.raw

@@ -1,5 +1,41 @@
 **Note**: Beyond PowerDNS 2.9.20, the Authoritative Server and Recursor are released separately.
 
+# PowerDNS Recursor 3.7.4
+Released January 13th 2016
+
+This release fixes [PowerDNS Security Advisory 2016-02](security/powerdns-advisory-2016-02.md).
+
+Changes since 3.7.3:
+
+- [commit 8c82b5d](https://github.com/PowerDNS/pdns/commit/8c82b5d): Don't parse spurious RRs in queries when we don't need them (Security Advisory [2016-02](security/powerdns-advisory-2016-02.md))
+- [commit 85243e0](https://github.com/PowerDNS/pdns/commit/85243e0): Add some sanity checking to rec_control wipe-cache
+- [commit 3d11d9f](https://github.com/PowerDNS/pdns/commit/3d11d9f): recursor: Require = in forward-zones (Aki Tuomi)
+- [commit 2b94bb4](https://github.com/PowerDNS/pdns/commit/2b94bb4): recursor: when replacing an expired entry, move it to the back
+- [commit 0cca616](https://github.com/PowerDNS/pdns/commit/0cca616): add lowercase-outgoing flag
+- [commit 24ef6ea](https://github.com/PowerDNS/pdns/commit/24ef6ea): devpollmplexer is leaky (Josef 'Jeff' Sipek)
+- [commit d2d4926](https://github.com/PowerDNS/pdns/commit/d2d4926): EMFILE was (out of filedescriptors, too many open files) was reported as an error that could be blamed on the remote nameserver instead of on the OS, causing throttle actions.
+- [commit fd4871c](https://github.com/PowerDNS/pdns/commit/fd4871c): mprove filedescriptor requesting code
+- [commit 9a39e6d](https://github.com/PowerDNS/pdns/commit/9a39e6d): devpollmplexer doesn't compile due to missing sigset_t (Josef 'Jeff' Sipek)
+- [commit 3b05796](https://github.com/PowerDNS/pdns/commit/3b05796): Update root hints for h.root-servers.net
+- [commit ef49a7c](https://github.com/PowerDNS/pdns/commit/ef49a7c): Port the 0x20 hashing to 3.7.3
+- [commit 7486add](https://github.com/PowerDNS/pdns/commit/7486add) and [commit d4a96ba](https://github.com/PowerDNS/pdns/commit/d4a96ba): Update YaHTTP (Aki Tuomi)
+
+# PowerDNS Authoritative Server 3.4.11
+Released January 13th 2016
+
+This release fixes PowerDNS Security Advisories [2016-02](security/powerdns-advisory-2016-02.md), [2016-03](security/powerdns-advisory-2016-03.md), [2016-04](security/powerdns-advisory-2016-04.md) and [2016-05](security/powerdns-advisory-2016-05.md).
+
+Changes since 3.4.10:
+
+- [commit ee79a63](https://github.com/PowerDNS/pdns/commit/ee79a63): Don't parse spurious RRs in queries when we don't need them (Security Advisory [2016-02](security/powerdns-advisory-2016-02.md))
+- [commit 2d37fd7](https://github.com/PowerDNS/pdns/commit/2d37fd7): Don't exit if the webserver can't accept a connection (Security Advisory [2016-03](security/powerdns-advisory-2016-03.md))
+- [commit 37d66d8](https://github.com/PowerDNS/pdns/commit/37d66d8): Fix TSIG computation (Security Advisory [2016-04](security/powerdns-advisory-2016-04.md))
+- [commit f82f0f6](https://github.com/PowerDNS/pdns/commit/f82f0f6): Correctly check unknown record content size (Security Advisory [2016-05](security/powerdns-advisory-2016-05.md))
+- [commit 0e612c1](https://github.com/PowerDNS/pdns/commit/0e612c1): Fix a possible memory leak in the webserver
+- [commit b4c5d8f](https://github.com/PowerDNS/pdns/commit/b4c5d8f): Lowercase the qname in getDomainInfo() and isMaster()
+- [commit c9713e8](https://github.com/PowerDNS/pdns/commit/c9713e8): Don't look up the packet cache for TSIG-enabled queries
+- [commit a6292e6](https://github.com/PowerDNS/pdns/commit/a6292e6): Fix a stack-based off-by-one write in the HTTP remote backend
+
 # PowerDNS Authoritative Server 3.4.10
 Released 2nd of September 2016
 

docs/markdown/security/powerdns-advisory-2016-02.md

@@ -0,0 +1,23 @@
+# PowerDNS Security Advisory 2016-02: Crafted queries can cause abnormal CPU usage
+
+CVE: CVE-2016-7068
+Date: December 15th 2016
+Credit: Florian Heinz and Martin Kluge
+Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1, PowerDNS Recursor up to and including 3.7.3, 4.0.3
+Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2 and PowerDNS Recursor 3.7.4, 4.0.4
+Severity: Medium
+Impact: Degraded service or Denial of service
+Exploit: This issue can be triggered by sending specially crafted query packets
+Risk of system compromise: No
+Solution: Upgrade to a non-affected version
+Workaround: Run dnsdist with the rules provided below in front of potentially affected servers.
+
+An issue has been found in PowerDNS allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour. This issue has been assigned CVE-2016-7068.
+
+PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. PowerDNS Recursor up to and including 3.7.3 and 4.0.3 are affected.
+
+dnsdist can be used to block crafted queries, using `RecordsCountRule()` and `RecordsTypeCountRule()` to block queries with crafted records.
+
+For those unable to upgrade to a new version, a minimal patch is [available](https://downloads.powerdns.com/patches/2016-02)
+
+We would like to thank Florian Heinz and Martin Kluge for finding and subsequently reporting this issue.

docs/markdown/security/powerdns-advisory-2016-03.md

@@ -0,0 +1,23 @@
+# PowerDNS Security Advisory 2016-03: Denial of service via the web server
+
+CVE: CVE-2016-7072
+Date: December 15th 2016
+Credit: Mongo
+Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1
+Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2
+Severity: Medium
+Impact: Degraded service or Denial of service
+Exploit: This issue can be triggered by opening a large number of simultaneous connections to the web server
+Risk of system compromise: No
+Solution: Upgrade to a non-affected version
+Workaround: Disable the web server, or restrict access to it via a firewall.
+
+An issue has been found in PowerDNS Authoritative Server allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process.
+While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.
+This issue has been assigned CVE-2016-7072.
+
+PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. The PowerDNS Recursor is not affected.
+
+For those unable to upgrade to a new version, a minimal patch is [available](https://downloads.powerdns.com/patches/2016-03)
+
+We would like to thank Mongo for finding and subsequently reporting this issue.

docs/markdown/security/powerdns-advisory-2016-04.md

@@ -0,0 +1,22 @@
+# PowerDNS Security Advisory 2016-04: Insufficient validation of TSIG signatures
+
+CVE: CVE-2016-7073 CVE-2016-7074
+Date: December 15th 2016
+Credit: Mongo
+Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1, PowerDNS Recursor from 4.0.0 and up to and including 4.0.3
+Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2, PowerDNS Recursor < 4.0.0, 4.0.4
+Severity: Medium
+Impact: Zone content alteration
+Exploit: This problem can be triggered by an attacker in position of man-in-the-middle
+Risk of system compromise: No
+Solution: Upgrade to a non-affected version
+
+Two issues have been found in PowerDNS Authoritative Server allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures.
+The first issue is a missing check of the TSIG time and fudge values in `AXFRRetriever`, leading to a possible replay attack. This issue has been assigned CVE-2016-7073.
+The second issue is a missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature. This issue has been assigned CVE-2016-7074.
+
+PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. PowerDNS Recursor from 4.0.0 up to and including 4.0.3 are affected.
+
+For those unable to upgrade to a new version, a minimal patch is [available](https://downloads.powerdns.com/patches/2016-04)
+
+We would like to thank Mongo for finding and subsequently reporting this issue.

docs/markdown/security/powerdns-advisory-2016-05.md

@@ -0,0 +1,21 @@
+# PowerDNS Security Advisory 2016-05: Crafted zone record can cause a denial of service
+
+CVE: CVE-2016-2120
+Date: December 15th 2016
+Credit: Mathieu Lafon
+Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1
+Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2
+Severity: Medium
+Impact: Denial of service
+Exploit: This issue can be triggered by inserting a specially crafted record in a zone
+Risk of system compromise: No
+Solution: Upgrade to a non-affected version
+
+An issue has been found in PowerDNS Authoritative Server allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record.
+The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary. This issue has been assigned CVE-2016-2120.
+
+PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. The PowerDNS Recursor is not affected.
+
+For those unable to upgrade to a new version, a minimal patch is [available](https://downloads.powerdns.com/patches/2016-05)
+
+We would like to thank Mathieu Lafon for finding and subsequently reporting this issue.

docs/mkdocs.yml

@@ -67,6 +67,10 @@ pages:
     - List of Settings: recursor/settings.md
   - Security:
     - Security Policy: security/index.md
+    - Advisory 2016-05: security/powerdns-advisory-2016-05.md
+    - Advisory 2016-04: security/powerdns-advisory-2016-04.md
+    - Advisory 2016-03: security/powerdns-advisory-2016-03.md
+    - Advisory 2016-02: security/powerdns-advisory-2016-02.md
     - Advisory 2016-01: security/powerdns-advisory-2016-01.md
     - Advisory 2015-03: security/powerdns-advisory-2015-03.md
     - Advisory 2015-02: security/powerdns-advisory-2015-02.md