[ASA-202005-14] unbound: denial of service

[Morten Linderud]

Arch Linux Security Advisory ASA-202005-14
==========================================

Severity: High
Date    : 2020-05-20
CVE-ID  : CVE-2020-12662 CVE-2020-12663
Package : unbound
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1164

Summary
=======

The package unbound before version 1.10.1-1 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 1.10.1-1.

# pacman -Syu "unbound>=1.10.1-1"

The problems have been fixed upstream in version 1.10.1.

Workaround
==========

None.

Description
===========

- CVE-2020-12662 (denial of service)

An issue has been found in unbound before 1.10.1, that makes it
possible to have a single incoming query result in a large number of
outgoing queries. This amplification makes it possible for Unbound to
be used in a denial of service attack. The researchers discovering this
called this attack the NXNSattack.This attack makes use of cache
bypassing using random subdomains in the NSDNAME in NS records. When
these delegation records are received during iteration, and the answer
does not contain glue records, a resolver has to send out a query to
the get the IP address for one of the names. When this query fails (for
example because the random name does not exist) a resolver will try the
next one. A large set of NS records with random names can result in a
large number of outgoing queries going to the same target.

- CVE-2020-12663 (denial of service)

A security issue has been found in Unbound before 1.1.0.1, in the
parser of received answers. Malformed answers received from upstream
servers can result in Unbound entering an infinite loop and thereby
becoming unresponsive.

Impact
======

A remote attacker can use the recursor has an amplification vector to
cause a denial of service via a crafted reply. In addition, a remote
attacker can crash the application via a crafted request.

References
==========

https://nlnetlabs.nl/projects/unbound/security-advisories/
https://nlnetlabs.nl/downloads/unbound/patch_cve_2020-12662_2020-12663.diff
http://www.nxnsattack.com/
https://security.archlinux.org/CVE-2020-12662
https://security.archlinux.org/CVE-2020-12663
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20200601/73085f0e/attachment.sig>