Memory Disclosure Vulnerability in PowerDNS Recursor by PowerDNS

CVE-2020-10030

Summary

A vulnerability exists in PowerDNS Recursor versions 4.1.0 through 4.3.0, allowing privileged attackers to exploit a stack-based out-of-bounds read due to improper handling of hostnames. On affected systems, the gethostname() function may not null-terminate the returned string if it exceeds the allocated buffer size. This can lead to unauthorized disclosure of uninitialized memory, potentially resulting in denial of service or arbitrary code execution under certain conditions. Systems running Linux and OpenBSD are not susceptible to this issue, as they handle hostname buffers correctly.

References