PDNS-Admin Authentication Bypass Vulnerability

Bugtraq ID:	27036
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 27 2007 12:00AM
Updated:	Jan 03 2008 06:10PM
Credit:	The vendor disclosed this issue.
Vulnerable:	PowerDNS Administrator PDNS-Admin 1.1.2
Not Vulnerable:	PowerDNS Administrator PDNS-Admin 1.1.3

PDNS-Admin Authentication Bypass Vulnerability

PDNS-Admin is prone to an authentication-bypass vulnerability that allows users to create new domains without permission.

Attackers can exploit this issue to perform unauthorized actions with the application.

This issue affects PDNS-Admin 1.1.2; other versions may also be affected.

PDNS-Admin Authentication Bypass Vulnerability

Attackers may exploit this issue through a browser.

PDNS-Admin Authentication Bypass Vulnerability

Solution:
The vendor has released PDNS-Admin 1.1.3 to address this issue. Please see the references for more information.


PowerDNS Administrator PDNS-Admin 1.1.2

• PowerDNS Administrator pdnsadmin-1.1.3.tar.gz
  http://www.iguanadons.net/downloads-PDNS-Admin-113-11

PDNS-Admin Authentication Bypass Vulnerability

References:

• PDNS-Admin Homepage (PowerDNS Administrator)