Input validation error in Unbound - CVE-2011-4528
Published: December 20, 2011 / Updated: July 28, 2020
Vulnerability identifier: #VU32833
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-4528
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows remote DNS servers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (daemon crash) via a crafted response. Per: http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt "1.4.14 is released with the patch, but 1.4.14rc1 is vulnerable.
Affected software
Unbound
Gentoo Linux
Fedora
unbound (Alpine package)
unbound
Gentoo Linux
Fedora
unbound (Alpine package)
unbound
How to mitigate CVE-2011-4528
Update to version 1.4.13p2.
Unbound - update to 1.4.13p2
unbound (Alpine package) - update to 1.4.13_p2-r0
unbound - addressed in versions 1.4.14-1.el5, 1.4.14-1.el6
unbound (Alpine package) - update to 1.4.13_p2-r0
unbound - addressed in versions 1.4.14-1.el5, 1.4.14-1.el6
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071525.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071535.html
- http://osvdb.org/77909
- http://secunia.com/advisories/47326
- http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt
- http://www.debian.org/security/2011/dsa-2370
- http://www.kb.cert.org/vuls/id/209659