Technitium DNS Server 15.5 went out on 19 September, and its release notes read like a security advisory first and a feature list second. Nine vulnerability fixes are in this release, most of them credited to outside researchers: Palo Alto Networks, Tel-Aviv University, Penn State, Nankai University. The details get specific enough to learn something from.
The resolver three
The three reported by Qifan Zhang at Palo Alto Networks are a small curriculum in resolver attacks. One used multiple CNAME and delegation hops to turn the server into an amplifier with a 4,096:1 packet ratio. A second poisoned the cache with an out-of-bailiwick DNAME record from an attacker-controlled zone, aimed at any domain you might later query. The third is the one to pause on: a crafted referral response injects out-of-bailiwick DS records and poisons the resolver’s cache in a way that disables DNSSEC validation for arbitrary signed zones. The mechanism that exists to catch forged answers was the thing being switched off.
The rest
The other six span the stack: a DNS-over-HTTPS/3 implementation that buffers until the server runs out of memory; a permission hole that let the record APIs write PTR entries into reverse zones the user had no rights to; a persistent denial of service from Penn State’s SyNSec Lab that parked a victim domain in a background task and needed a restart to clear; an off-path cache poisoning chain from Tel-Aviv University; stored cross-site scripting and a zone-name validation bypass in the web layer from Nankai’s AOSP Lab.
None of these are described as exploited, and this is a resolver most of us run for one household. But a home DNS server is exactly the kind of thing that quietly ends up in front of the internet: a forwarder, a DoH endpoint, a subdomain for the lab. The fixes land in v15.5.0, tagged on GitHub.
What else is in it
The features are real, just smaller. LDAP authentication arrives (a pull request from Roy Hagland), so setups that prefer a directory login are no longer stuck with the shared admin password. There is a new Zone File Editor in the GUI for primary and conditional-forwarder zones. Automation can use predefined static API sessions through an environment variable, and the web root is configurable now for people running custom GUIs. One thing leaves: the Auto Prefetch feature is gone, on the grounds that it cost more resources than it saved.
My read
Release notes that say “security improvements” tell you nothing. This changelog tells you who found what, how the attack worked, and which version fixes it. That is the difference between a project that fixes things and one that closes them quietly. If Technitium is serving your answers, this is the week to update it by hand and read the notes as you go.
Source: Technitium DNS Server v15.5.0 release notes