#VU29237 Buffer overflow in Unbound - CVE-2019-16866
Published: June 25, 2020
Vulnerability identifier: #VU29237
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2019-16866
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Unbound
Unbound
Software vendor:
NLnet Labs
NLnet Labs
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack
The vulnerability exists due to a boundary error when processing NOTIFY queries in Unbound. A remote attacker can send a specially crafted NOTIFY query, trigger uninitialized memory access and crash the service.
Successful exploitation of this vulnerability requires that the source IP address of the query matches an access-control rule.
Remediation
Install updates from vendor's website.
External links
- https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/
- https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt
- https://seclists.org/bugtraq/2019/Oct/23
- https://usn.ubuntu.com/4149-1/
- https://www.debian.org/security/2019/dsa-4544