CVE-2025-59030
📋 TL;DR
This vulnerability in PowerDNS Recursor allows attackers to trigger removal of cached DNS records by sending NOTIFY queries over TCP. This enables DNS cache poisoning attacks that could redirect users to malicious sites. Organizations running PowerDNS Recursor are affected.
💻 Affected Systems
- PowerDNS Recursor
📦 What is this software?
Recursor by Powerdns
Recursor by Powerdns
Recursor by Powerdns
⚠️ Risk & Real-World Impact
Worst Case
Attackers could poison DNS cache to redirect all users to malicious sites, enabling phishing, malware distribution, or credential theft across entire organizations.
Likely Case
Targeted DNS cache poisoning affecting specific domains, potentially redirecting users to phishing sites or intercepting sensitive communications.
If Mitigated
Limited impact with proper network segmentation and monitoring, though DNS resolution could still be temporarily disrupted.
🎯 Exploit Status
Exploitation requires network access to the recursor's TCP port (typically 53).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9.7
Vendor Advisory: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html
Restart Required: Yes
Instructions:
1. Download PowerDNS Recursor 4.9.7 from official repository. 2. Stop the recursor service. 3. Install the updated package. 4. Start the recursor service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable TCP NOTIFY
allConfigure recursor to reject NOTIFY queries over TCP
Add 'tcp-notify=no' to recursor.conf
Restrict TCP Access
allLimit TCP connections to trusted sources only
Configure firewall rules to restrict TCP/53 access
🧯 If You Can't Patch
- Implement strict firewall rules to limit TCP access to PowerDNS Recursor from trusted sources only
- Monitor DNS logs for unusual NOTIFY query patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check PowerDNS Recursor version: pdns_recursor --versionCheck Version:
pdns_recursor --version | grep 'Version'Verify Fix Applied:
Verify version is 4.9.7 or later and check configuration for tcp-notify setting📡 Detection & Monitoring
Log Indicators:
- Unusual NOTIFY query patterns
- Multiple NOTIFY queries from single sources
- Cache flush events
Network Indicators:
- TCP connections to port 53 followed by NOTIFY queries
- Unusual DNS response patterns
SIEM Query:
source="powerdns" AND (query_type="NOTIFY" OR message="cache.*flush")