Allele Security Alert
Lua hooks are not applied in certain configurations
PowerDNS Recursor from 4.1.4 up to and including 4.1.8
PowerDNS Recursor 4.1.9
Proof of concept
An issue has been found in PowerDNS Recursor where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.
When the recursor is configured to run with more than one thread (threads=X) and to do the distribution of incoming queries to the worker threads itself (pdns-distributes-queries=yes), the Lua script is not properly loaded in the thread handling incoming TCP queries, causing the Lua hooks to not be properly applied.
PowerDNS Recursor 4.1.9 Released
PowerDNS Security Advisory 2019-01: Lua hooks are not applied in certain configurations
PowerDNS Security Advisories 2011-01 and 2019-02
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: February 1, 2019