CVE-2020-24698
📋 TL;DR
A double-free vulnerability in PowerDNS Authoritative when GSS-TSIG is enabled allows remote unauthenticated attackers to crash the service or potentially execute arbitrary code. This affects PowerDNS Authoritative servers with the experimental GSS-TSIG feature enabled. Attackers can exploit this by sending specially crafted DNS queries with GSS-TSIG signatures.
💻 Affected Systems
- PowerDNS Authoritative
📦 What is this software?
Authoritative by Powerdns
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or use as a foothold for lateral movement.
Likely Case
Service crash causing DNS resolution outages and denial of service for dependent systems.
If Mitigated
No impact if GSS-TSIG is disabled or systems are patched/isolated.
🎯 Exploit Status
Exploitation requires crafting specific DNS queries with GSS-TSIG signatures. Public advisory includes technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.1 and later
Vendor Advisory: https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html
Restart Required: Yes
Instructions:
1. Upgrade PowerDNS Authoritative to version 4.3.1 or later. 2. Stop PowerDNS service. 3. Install updated package. 4. Restart PowerDNS service. 5. Verify service is running and responding to queries.
🔧 Temporary Workarounds
Disable GSS-TSIG feature
allDisable the experimental GSS-TSIG feature if not required for your environment.
Recompile PowerDNS without --enable-experimental-gss-tsig flag
Ensure GSS-TSIG is not enabled in configuration
Network isolation
linuxRestrict access to PowerDNS servers to trusted networks only.
iptables -A INPUT -p udp --dport 53 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -s trusted_network -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP
🧯 If You Can't Patch
- Disable GSS-TSIG feature immediately if enabled
- Implement strict network controls to limit access to PowerDNS servers
🔍 How to Verify
Check if Vulnerable:
Check if PowerDNS is running with GSS-TSIG enabled: grep -i gss /etc/powerdns/pdns.conf or check compilation flags if source build.Check Version:
pdns_server --version | grep -o 'PowerDNS Authoritative Server [0-9.]*'Verify Fix Applied:
Verify PowerDNS version is 4.3.1 or later: pdns_server --version📡 Detection & Monitoring
Log Indicators:
- Unexpected crashes or restarts of pdns_server
- Log entries showing malformed GSS-TSIG queries
- High volume of queries with GSS-TSIG signatures from single sources
Network Indicators:
- DNS queries with GSS-TSIG opcodes from unexpected sources
- Traffic spikes to port 53/udp or 53/tcp
SIEM Query:
source="powerdns" AND ("crash" OR "segfault" OR "double free") OR (query_type="GSS-TSIG" AND count>threshold)