An unauthenticated remote attacker can cause a denial of service in PowerDNS Recursor by sending malicious TCP NOTIFY queries that purge the server cache.

This vulnerability involves improper handling of incoming NOTIFY queries, classified under CWE-276, which allows an unauthenticated remote attacker to disrupt service availability by clearing cached DNS data.

The exploitation of this vulnerability results in a denial of service condition by forcing the DNS recursor to flush its cache, which significantly increases latency and load on upstream recursive servers. With a CVSS score of 7.5, this high severity flaw poses a substantial risk to network performance and service reliability, potentially impacting all downstream clients that depend on the affected recursor for name resolution.

Immediate Action: Upgrade PowerDNS Recursor to version 5.3.3, 5.2.7, 5.1.9, or later to incorporate the vendor provided fix.

Proactive Monitoring: Monitor DNS traffic patterns for an unusual volume of NOTIFY queries over TCP and investigate sudden spikes in cache miss rates or recursor latency.

Compensating Controls: Implement access control lists on the firewall to restrict TCP NOTIFY queries to trusted sources only, preventing external entities from interacting with the vulnerable recursor endpoint.

Public Exploit Available: No

Given the high severity of this denial of service vulnerability and the ease with which it can be triggered over TCP, administrators should prioritize updating to the latest patched versions of PowerDNS Recursor. Immediate application of these patches is necessary to ensure the continued stability and performance of your DNS infrastructure.