在 PowerDNS Recursor 4.1.x 版本低于 4.1.9 的版本中发现了一个问题，来自权威服务器收到的响应中答案部分的记录，如果这些服务器的 AA 标志未设置，则未得到正确处理。

Successful exploitation of CVE-2019-3807 enables an attacker to bypass DNSSEC validation, effectively undermining the security of DNS resolution. This could allow an attacker to redirect users to malicious websites, intercept sensitive data transmitted over DNS, or perform other DNS-based attacks. The impact is particularly severe for organizations relying on DNSSEC to ensure the integrity of their DNS data. While the CVSS score is LOW, the potential for widespread impact through DNS manipulation warrants attention.

Organizations heavily reliant on DNSSEC for security and those running older versions of PowerDNS Recursor (4.1.0 - 4.1.8) are at increased risk. Shared hosting environments utilizing vulnerable PowerDNS Recursor instances are also particularly susceptible.

• linux / server:

journalctl -u pdnsrecursor | grep -i "dnssec validation"

• linux / server:

ps aux | grep pdnsrecursor

• generic web: Check DNS server logs for unusual query patterns or responses from authoritative servers without the AA flag.

1. 2019-01-29Disclosure

   disclosure

1. 已保留2019-01-03
2. 发布日期2019-01-29
3. 修改日期2024-08-04
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2019-3807 is to upgrade PowerDNS Recursor to version 4.1.9 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting queries from untrusted authoritative servers or implementing stricter DNSSEC validation policies. Monitor DNS logs for suspicious activity and consider implementing intrusion detection systems (IDS) to identify potential exploitation attempts. After upgrade, confirm by querying authoritative servers without the AA flag and verifying DNSSEC validation is enforced.