Arch Linux Security Advisory ASA-202005-14 ========================================== Severity: High Date : 2020-05-20 CVE-ID : CVE-2020-12662 CVE-2020-12663 Package : unbound Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1164 Summary ======= The package unbound before version 1.10.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.10.1-1. # pacman -Syu "unbound>=1.10.1-1" The problems have been fixed upstream in version 1.10.1. Workaround ========== None. Description =========== - CVE-2020-12662 (denial of service) An issue has been found in unbound before 1.10.1, that makes it possible to have a single incoming query result in a large number of outgoing queries. This amplification makes it possible for Unbound to be used in a denial of service attack. The researchers discovering this called this attack the NXNSattack.This attack makes use of cache bypassing using random subdomains in the NSDNAME in NS records. When these delegation records are received during iteration, and the answer does not contain glue records, a resolver has to send out a query to the get the IP address for one of the names. When this query fails (for example because the random name does not exist) a resolver will try the next one. A large set of NS records with random names can result in a large number of outgoing queries going to the same target. - CVE-2020-12663 (denial of service) A security issue has been found in Unbound before 1.1.0.1, in the parser of received answers. Malformed answers received from upstream servers can result in Unbound entering an infinite loop and thereby becoming unresponsive. Impact ====== A remote attacker can use the recursor has an amplification vector to cause a denial of service via a crafted reply. In addition, a remote attacker can crash the application via a crafted request. References ========== https://nlnetlabs.nl/projects/unbound/security-advisories/ https://nlnetlabs.nl/downloads/unbound/patch_cve_2020-12662_2020-12663.diff http://www.nxnsattack.com/ https://security.archlinux.org/CVE-2020-12662 https://security.archlinux.org/CVE-2020-12663