Vulnerability CVE-2020-14196

Vulnerability Name:

CVE-2020-14196 (CCN-184481)

Assigned:

2020-07-01

Published:

2020-07-01

Updated:

2020-10-17

Summary:

In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.

CVSS v3 Severity:

5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-863

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2020-14196

Source: SUSE
Type: Third Party Advisory
openSUSE-SU-2020:1005

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:1055

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:1101

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:1687

Source: CCN
Type: PowerDNS Web site
PowerDNS Security Advisory 2020-04: Access restriction bypass

Source: CONFIRM
Type: Vendor Advisory
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-04.html

Source: XF
Type: UNKNOWN
powerdns-cve202014196-sec-bypass(184481)

Source: FEDORA
Type: UNKNOWN
FEDORA-2020-1d812d5546

Source: CCN
Type: oss-sec Mailing List, Wed, 1 Jul 2020 14:10:33 +0200
PowerDNS Recursor 4.3.2, 4.2.3. and 4.1.17 released fixing CVE-2020-14196: Access restriction,bypass

Source: CONFIRM
Type: Mailing List, Release Notes, Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/07/01/1

Vulnerable Configuration:

Configuration 1:

cpe:/a:powerdns:recursor:*:*:*:*:*:*:*:* (Version <= 4.1.16)

OR cpe:/a:powerdns:recursor:*:*:*:*:*:*:*:* (Version >= 4.2.0 and <= 4.2.2)

OR cpe:/a:powerdns:recursor:*:*:*:*:*:*:*:* (Version >= 4.3.0 and <= 4.3.1)

Configuration CCN 1:

cpe:/a:powerdns:recursor:4.3.1:*:*:*:*:*:*:*

OR cpe:/a:powerdns:recursor:4.2.2:*:*:*:*:*:*:*

OR cpe:/a:powerdns:recursor:4.1.16:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:202014196	V	CVE-2020-14196	2022-06-30
oval:org.opensuse.security:def:113104	P	pdns-recursor-4.5.5-1.3 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:64639	P	Security update for xorg-x11-server (Important)	2021-12-14
oval:org.opensuse.security:def:64799	P	Security update for samba (Important)	2021-11-15
oval:org.opensuse.security:def:106539	P	pdns-recursor-4.5.5-1.3 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:63194	P	apache2-mod_jk-1.2.43-3.3.1 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:74375	P	Security update for ghostscript (Critical)	2021-09-15
oval:org.opensuse.security:def:64765	P	Security update for ghostscript (Critical)	2021-09-15
oval:org.opensuse.security:def:64741	P	Security update for the Linux Kernel (Important)	2021-08-14
oval:org.opensuse.security:def:63378	P	stunnel-5.57-3.11.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63320	P	bind-9.16.6-20.39 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63386	P	yast2-rmt-1.3.2-3.3.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63487	P	liblcms2-2-32bit-2.9-3.3.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63516	P	python2-waitress-1.4.3-3.3.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:62988	P	ant-1.10.7-4.3.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:63046	P	xorg-x11-server-sdk-1.20.3-22.5.30.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62991	P	binutils-devel-32bit-2.35.1-7.18.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:63016	P	jcl-over-slf4j-1.7.30-1.34 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62767	P	libSDL2-2_0-0-2.0.8-9.63 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:64532	P	Security update for xterm (Important)	2021-06-18
oval:org.opensuse.security:def:64531	P	Security update for python-rsa (Important)	2021-06-17
oval:org.opensuse.security:def:64521	P	Security update for qemu (Important)	2021-06-08
oval:org.opensuse.security:def:64657	P	Security update for glibc (Important)	2021-02-26
oval:org.opensuse.security:def:64658	P	Security update for python-Jinja2 (Important)	2021-02-26
oval:org.opensuse.security:def:64565	P	Security update for cups (Moderate)	2021-02-02
oval:org.opensuse.security:def:64323	P	Security update for perl-Convert-ASN1 (Moderate)	2021-01-21
oval:org.opensuse.security:def:74631	P	Security update for ImageMagick (Moderate)	2021-01-15
oval:org.opensuse.security:def:64453	P	Security update for python3 (Important)	2020-12-23
oval:org.opensuse.security:def:64281	P	Security update for xen (Moderate)	2020-12-18
oval:org.opensuse.security:def:62720	P	spice-vdagent-0.19.0-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63612	P	dia-0.97.3-4.3.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63110	P	rmt-server-pubcloud-1.2.2-1.15 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63114	P	kernel-azure-5.3.18-16.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62566	P	libmp3lame-devel-3.100-1.33 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63176	P	python3-pywbem-0.11.0-2.21 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63117	P	python-azure-agent-2.2.45-3.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63142	P	apache2-mod_nss-1.0.17-1.28 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62567	P	libmpg123-0-1.25.10-1.38 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62696	P	librsvg-devel-2.46.4-1.31 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62897	P	cvs-1.12.12-2.30 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62590	P	libyaml-cpp0_6-0.6.1-2.15 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63248	P	389-ds-1.4.3.9~git0.3eb8617f6-1.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62697	P	libsmi-devel-0.4.8-1.29 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62984	P	subversion-bash-completion-1.10.6-3.6.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63613	P	enigmail-2.1.5-3.22.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:25614	P	Security update for perl-DBI (Important)	2020-12-01
oval:org.opensuse.security:def:64192	P	ctdb on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25777	P	Security update for flash-player (Critical)	2020-12-01
oval:org.opensuse.security:def:63837	P	Security update for clamav (Moderate)	2020-12-01
oval:org.opensuse.security:def:25755	P	Security update for libreoffice (Moderate)	2020-12-01
oval:org.opensuse.security:def:64309	P	libXt-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26494	P	Security update for pdns-recursor (Important)	2020-12-01
oval:org.opensuse.security:def:26451	P	Security update for chromium (Important)	2020-12-01
oval:org.opensuse.security:def:25059	P	Security update for apache2-mod_auth_openidc (Important)	2020-12-01
oval:org.opensuse.security:def:64069	P	Security update for MozillaFirefox (Moderate)	2020-12-01
oval:org.opensuse.security:def:65037	P	Security update for libqt5-qtbase (Important)	2020-12-01
oval:org.opensuse.security:def:25331	P	Security update for samba (Important)	2020-12-01
oval:org.opensuse.security:def:64411	P	libzip-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25242	P	Security update for mariadb-100 (Moderate)	2020-12-01
oval:org.opensuse.security:def:74986	P	Security update for pdns-recursor (Moderate)	2020-12-01
oval:org.opensuse.security:def:25622	P	Security update for wavpack (Moderate)	2020-12-01
oval:org.opensuse.security:def:74505	P	Security update for chromium (Important)	2020-12-01
oval:org.opensuse.security:def:25464	P	Security update for java-11-openjdk (Important)	2020-12-01
oval:org.opensuse.security:def:64435	P	perl-LWP-Protocol-https on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:63963	P	Security update for mariadb (Moderate)	2020-12-01
oval:org.opensuse.security:def:25763	P	Security Update for Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:63690	P	Security update for sysstat (Low)	2020-12-01
oval:org.opensuse.security:def:26459	P	Security update for chromium (Important)	2020-12-01
oval:org.opensuse.security:def:64395	P	libudisks2-0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25813	P	Security update for libssh (Moderate)	2020-12-01
oval:org.opensuse.security:def:63742	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:64925	P	Security update for libarchive (Moderate)	2020-12-01
oval:org.opensuse.security:def:25040	P	Security update for sudo (Important)	2020-12-01
oval:org.opensuse.security:def:25250	P	Security update for gd (Moderate)	2020-12-01
oval:org.opensuse.security:def:75112	P	Security update for pdns-recursor (Important)	2020-12-01
oval:org.opensuse.security:def:25115	P	Security update for java-1_7_1-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:64073	P	Security update for perl-DBI (Important)	2020-12-01
oval:org.opensuse.security:def:74853	P	Security update for ovmf (Moderate)	2020-12-01
oval:org.opensuse.security:def:25472	P	Security update for apache2-mod_perl (Moderate)	2020-12-01
oval:org.opensuse.security:def:25380	P	Security update for apache2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:63816	P	Security update for samba (Important)	2020-12-01
oval:org.opensuse.security:def:25667	P	Security update for u-boot (Important)	2020-12-01
oval:org.opensuse.security:def:74501	P	Security update for pdns-recursor (Moderate)	2020-12-01
oval:org.opensuse.security:def:25821	P	Security update for lhasa (Moderate)	2020-12-01
oval:org.opensuse.security:def:64066	P	Security update for squid (Critical)	2020-12-01
oval:org.opensuse.security:def:25769	P	Security update for gd (Low)	2020-12-01
oval:org.opensuse.security:def:25048	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:64867	P	Security update for python-SQLAlchemy (Important)	2020-12-01
oval:org.opensuse.security:def:64179	P	Security update for kernel-firmware (Important)	2020-12-01
oval:org.opensuse.security:def:26486	P	Security update for pdns-recursor (Moderate)	2020-12-01
oval:org.opensuse.security:def:25123	P	Security update for ucode-intel (Moderate)	2020-12-01
oval:org.opensuse.security:def:64203	P	ruby2.5-rubygem-railties-5_1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:74979	P	Security update for rubygem-puma (Moderate)	2020-12-01
oval:org.opensuse.security:def:25051	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:63939	P	Security update for qemu (Moderate)	2020-12-01
oval:org.opensuse.security:def:64911	P	Security update for ghostscript (Important)	2020-12-01
oval:org.opensuse.security:def:25388	P	Security update for libsolv (Moderate)	2020-12-01
oval:org.opensuse.security:def:25323	P	Security update for libproxy (Important)	2020-12-01
oval:org.opensuse.security:def:25675	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:96378	P	Security update for pdns-recursor (Important)	2020-10-17
oval:org.opensuse.security:def:93535	P	Security update for pdns-recursor (Important)	2020-10-17
oval:org.opensuse.security:def:103068	P	Security update for pdns-recursor (Important)	2020-10-17
oval:org.opensuse.security:def:110807	P	Security update for pdns-recursor (Important)	2020-10-17
oval:org.opensuse.security:def:100248	P	Security update for pdns-recursor (Important)	2020-10-17
oval:org.opensuse.security:def:109725	P	Security update for pdns-recursor (Important)	2020-10-17
oval:org.opensuse.security:def:110255	P	Security update for pdns-recursor (Important)	2020-10-17
oval:org.opensuse.security:def:103035	P	Security update for pdns-recursor (Moderate)	2020-07-27
oval:org.opensuse.security:def:109692	P	Security update for pdns-recursor (Moderate)	2020-07-27
oval:org.opensuse.security:def:96345	P	Security update for pdns-recursor (Moderate)	2020-07-27
oval:org.opensuse.security:def:109690	P	Security update for pdns-recursor (Moderate)	2020-07-24
oval:org.opensuse.security:def:96343	P	Security update for pdns-recursor (Moderate)	2020-07-24
oval:org.opensuse.security:def:103033	P	Security update for pdns-recursor (Moderate)	2020-07-24
oval:org.opensuse.security:def:110681	P	Security update for pdns-recursor (Moderate)	2020-07-19
oval:org.opensuse.security:def:100205	P	Security update for pdns-recursor (Moderate)	2020-07-19
oval:org.opensuse.security:def:110125	P	Security update for pdns-recursor (Moderate)	2020-07-19
oval:org.opensuse.security:def:93492	P	Security update for pdns-recursor (Moderate)	2020-07-19

BACK