Add security advisories

diff --git a/docs/markdown/security/powerdns-advisory-2016-02.md b/docs/markdown/security/powerdns-advisory-2016-02.md
new file mode 100644 (file)
index 0000000..c342993
--- /dev/null
+++ b/docs/markdown/security/powerdns-advisory-2016-02.md
@@ -0,0 +1,23 @@
+# PowerDNS Security Advisory 2016-02: Crafted queries can cause abnormal CPU usage
+
+CVE: CVE-2016-7068
+Date: December 15th 2016
+Credit: Florian Heinz and Martin Kluge
+Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1, PowerDNS Recursor up to and including 3.7.3, 4.0.3
+Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2 and PowerDNS Recursor 3.7.4, 4.0.4
+Severity: Medium
+Impact: Degraded service or Denial of service
+Exploit: This issue can be triggered by sending specially crafted query packets
+Risk of system compromise: No
+Solution: Upgrade to a non-affected version
+Workaround: Run dnsdist with the rules provided below in front of potentially affected servers.
+
+An issue has been found in PowerDNS allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour. This issue has been assigned CVE-2016-7068.
+
+PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. PowerDNS Recursor up to and including 3.7.3 and 4.0.3 are affected.
+
+dnsdist can be used to block crafted queries, using `RecordsCountRule()` and `RecordsTypeCountRule()` to block queries with crafted records.
+
+For those unable to upgrade to a new version, a minimal patch is [available](https://downloads.powerdns.com/patches/2016-02)
+
+We would like to thank Florian Heinz and Martin Kluge for finding and subsequently reporting this issue.

diff --git a/docs/markdown/security/powerdns-advisory-2016-03.md b/docs/markdown/security/powerdns-advisory-2016-03.md
new file mode 100644 (file)
index 0000000..eb5dad9
--- /dev/null
+++ b/docs/markdown/security/powerdns-advisory-2016-03.md
@@ -0,0 +1,23 @@
+# PowerDNS Security Advisory 2016-03: Denial of service via the web server
+
+CVE: CVE-2016-7072
+Date: December 15th 2016
+Credit: Mongo
+Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1
+Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2
+Severity: Medium
+Impact: Degraded service or Denial of service
+Exploit: This issue can be triggered by opening a large number of simultaneous connections to the web server
+Risk of system compromise: No
+Solution: Upgrade to a non-affected version
+Workaround: Disable the web server, or restrict access to it via a firewall.
+
+An issue has been found in PowerDNS Authoritative Server allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process.
+While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.
+This issue has been assigned CVE-2016-7072.
+
+PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. The PowerDNS Recursor is not affected.
+
+For those unable to upgrade to a new version, a minimal patch is [available](https://downloads.powerdns.com/patches/2016-03)
+
+We would like to thank Mongo for finding and subsequently reporting this issue.

diff --git a/docs/markdown/security/powerdns-advisory-2016-04.md b/docs/markdown/security/powerdns-advisory-2016-04.md
new file mode 100644 (file)
index 0000000..26939fc
--- /dev/null
+++ b/docs/markdown/security/powerdns-advisory-2016-04.md
@@ -0,0 +1,22 @@
+# PowerDNS Security Advisory 2016-04: Insufficient validation of TSIG signatures
+
+CVE: CVE-2016-7073 CVE-2016-7074
+Date: December 15th 2016
+Credit: Mongo
+Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1, PowerDNS Recursor from 4.0.0 and up to and including 4.0.3
+Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2, PowerDNS Recursor < 4.0.0, 4.0.4
+Severity: Medium
+Impact: Zone content alteration
+Exploit: This problem can be triggered by an attacker in position of man-in-the-middle
+Risk of system compromise: No
+Solution: Upgrade to a non-affected version
+
+Two issues have been found in PowerDNS Authoritative Server allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures.
+The first issue is a missing check of the TSIG time and fudge values in `AXFRRetriever`, leading to a possible replay attack. This issue has been assigned CVE-2016-7073.
+The second issue is a missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature. This issue has been assigned CVE-2016-7074.
+
+PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. PowerDNS Recursor from 4.0.0 up to and including 4.0.3 are affected.
+
+For those unable to upgrade to a new version, a minimal patch is [available](https://downloads.powerdns.com/patches/2016-04)
+
+We would like to thank Mongo for finding and subsequently reporting this issue.

diff --git a/docs/markdown/security/powerdns-advisory-2016-05.md b/docs/markdown/security/powerdns-advisory-2016-05.md
new file mode 100644 (file)
index 0000000..9468664
--- /dev/null
+++ b/docs/markdown/security/powerdns-advisory-2016-05.md
@@ -0,0 +1,21 @@
+# PowerDNS Security Advisory 2016-05: Crafted zone record can cause a denial of service
+
+CVE: CVE-2016-2120
+Date: December 15th 2016
+Credit: Mathieu Lafon
+Affects: PowerDNS Authoritative Server up to and including 3.4.10, 4.0.1
+Not affected: PowerDNS Authoritative Server 3.4.11, 4.0.2
+Severity: Medium
+Impact: Denial of service
+Exploit: This issue can be triggered by inserting a specially crafted record in a zone
+Risk of system compromise: No
+Solution: Upgrade to a non-affected version
+
+An issue has been found in PowerDNS Authoritative Server allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record.
+The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary. This issue has been assigned CVE-2016-2120.
+
+PowerDNS Authoritative Server up to and including 3.4.10 and 4.0.1 are affected. The PowerDNS Recursor is not affected.
+
+For those unable to upgrade to a new version, a minimal patch is [available](https://downloads.powerdns.com/patches/2016-05)
+
+We would like to thank Mathieu Lafon for finding and subsequently reporting this issue.

diff --git a/docs/mkdocs.yml b/docs/mkdocs.yml
index 2f41647d8353981c1718fa525e84e00e207e2308..ac49ceeae99d6d5e94f61cf5ee0ec17d52d5ab3d 100644 (file)
--- a/docs/mkdocs.yml
+++ b/docs/mkdocs.yml
@@ -72,6 +72,10 @@ pages:
     - List of Settings: recursor/settings.md
   - Security:
     - Security Policy: security/index.md
+    - Advisory 2016-05: security/powerdns-advisory-2016-05.md
+    - Advisory 2016-04: security/powerdns-advisory-2016-04.md
+    - Advisory 2016-03: security/powerdns-advisory-2016-03.md
+    - Advisory 2016-02: security/powerdns-advisory-2016-02.md
     - Advisory 2016-01: security/powerdns-advisory-2016-01.md
     - Advisory 2015-03: security/powerdns-advisory-2015-03.md
     - Advisory 2015-02: security/powerdns-advisory-2015-02.md