Buffer overflow in Unbound - CVE-2019-16866
Published: June 25, 2020
Vulnerability identifier: #VU29237
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16866
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack
The vulnerability exists due to a boundary error when processing NOTIFY queries in Unbound. A remote attacker can send a specially crafted NOTIFY query, trigger uninitialized memory access and crash the service.
Successful exploitation of this vulnerability requires that the source IP address of the query matches an access-control rule.
Affected software
Unbound
Arch Linux
Fedora
unbound (Alpine package)
unbound
Robotic Process Automation for Cloud Pak
Arch Linux
Fedora
unbound (Alpine package)
unbound
Robotic Process Automation for Cloud Pak
How to mitigate CVE-2019-16866
Install updates from vendor's website.
Unbound - update to 1.9.4
unbound (Alpine package) - update to 1.7.3-r1
unbound - addressed in versions 1.9.4-1.fc30, 1.9.4-1.fc31
Robotic Process Automation for Cloud Pak - update to 21.0.6
unbound (Alpine package) - update to 1.7.3-r1
unbound - addressed in versions 1.9.4-1.fc30, 1.9.4-1.fc31
Robotic Process Automation for Cloud Pak - update to 21.0.6
External References
- https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/
- https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt
- https://seclists.org/bugtraq/2019/Oct/23
- https://usn.ubuntu.com/4149-1/
- https://www.debian.org/security/2019/dsa-4544