Critical PowerDNS Recursor Security Vulnerabilities: please upgrade ASAP to

Jan 6, 2010

Dear PowerDNS Users,

Two major vulnerabilities have recently been discovered in the PowerDNS
Recursor (all versions up to and including Over the past two
weeks, these vulnerabilities have been addressed, resulting in PowerDNS

Given the nature and magnitude of these vulnerabilities, ALL PowerDNS
versions of the PowerDNS Authoritative Server are affected.

PowerDNS Recursor as been thoroughly tested, and has in fact been in
production for a week at some major sites already. No problems have been
reported. does not include anything other than security updates.

The two major vulnerabilities can lead to a FULL SYSTEM COMPROMISE, as well
as cache poisoning, connecting your users to possibly malicious IP addresses.

These vulnerabilities were discovered by a third party that for now prefers
not to be named. PowerDNS is however very grateful for their help. More
details are available on:

Debian, FreeBSD, Gentoo and SuSE are processing the changed packages, and
will be releasing security updates shortly. Ubuntu does not provide security
updates for PowerDNS, so Ubuntu users must take immediate action and
download our packages.

RHEL4/5, CentOS packages are available (care of Kees Monshouwer) here:

Updated packages for .deb based systems are available here:

Updated packages for .rpm based systems are available here:

Source code is available here:

Special ‘upgrade option of last resort’ (old systems)
In addition, as a special service, we are also providing two precompiled
fully static Linux binaries as an ‘upgrade option of last resort’:

These two binaries are suitable of our .deb or .rpm files somehow refuse to
load (which happens on RHEL version 3, for example).

Download the appropriate executable, rename to pdns_recursor, set the
executable bit (chmod a+x pdns_recursor), and ‘mv’ the executable over

If you need any help in upgrading, please do not hesitate to contact us.

Kind regards,

Bert Hubert


About the author

Bert Hubert

Bert Hubert

Principal, PowerDNS


Related Articles

PowerDNS Authoritative Server 3.0 has been released!

Available from: * *...

Bert Hubert 07/6/11

Authoritative Server 3.4.0 Release Candidate 2

Warning Version 3.4.0 of the PowerDNS Authoritative Server is a major upgrade if you are coming from 2.9.x. Additionally, if...

Peter van Dijk 09/3/14

Recursor 3.5.2 released

Released June 7th, 2013 Downloads: Official download page native RHEL5/6 packages from Kees Monshouwer This is a stability...

Peter van Dijk 06/6/13

Recursor 3.6.2

Note Version 3.6.2 is a bugfix update to 3.6.1. Released on the 30th of October 2014. Official download page A list of...

Peter van Dijk 10/5/14