Missing authorization in Unbound - CVE-2024-1488

Vulnerability identifier: #VU87749

CSH Severity: Low

CVSS v4 BT: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-1488

CWE-ID: CWE-862

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to missing authorization in the unbound.service that listens on localhost on port 8953. A local user can send a specially crafted request and alter the server configuration.

Unbound
Amazon Linux AMI
Oracle Linux
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
openEuler
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
OpenShift Service Mesh
OpenShift Virtualization
LANTIME Operating System Firmware (LTOS)
Juniper Secure Analytics (JSA)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
unbound (Red Hat package)
unbound-devel
unbound
unbound-libs
unbound-debugsource
python3-unbound
unbound-debuginfo
unbound-help
Juniper Junos Space
Red Hat Migration Toolkit for Applications
IBM Qradar SIEM

Install updates from vendor's website.

Unbound - update to 1.19.1
Migration Toolkit for Containers - update to 1.7.15
OpenShift Service Mesh - update to 2.5.1
OpenShift Virtualization - update to 4.14.5
Red Hat OpenShift Container Platform - addressed in versions 4.13.45, 4.14.32, 4.14.33, 4.14.48, 4.15.10, 4.16.15, 4.17.0
LANTIME Operating System Firmware (LTOS) - update to 7.08.011
Juniper Secure Analytics (JSA) - addressed in versions 7.5.0 UP8 IF03, 7.5.0 UP11 IF03
Juniper Junos Space - update to 24.1R2
unbound (Red Hat package) - addressed in versions 1.7.3-12.el8_2.1, 1.7.3-15.el8_4.1, 1.7.3-17.el8_6.4, 1.13.1-13.el9_0.4, 1.16.2-3.el9_2.4, 1.16.2-3.el9_3.5, 1.16.2-5.el8_8.4, 1.16.2-5.el8_9.6, 1.16.2-5.8.el8_10
unbound-devel - update to 1.11.0-11
unbound - update to 1.11.0-11
unbound-libs - update to 1.11.0-11
unbound-debugsource - update to 1.11.0-11
python3-unbound - update to 1.11.0-11
unbound-debuginfo - update to 1.11.0-11
unbound-help - update to 1.11.0-11
unbound-libs - addressed in versions 1.16.2-7, 1.16.2-8
python3-unbound - addressed in versions 1.16.2-7, 1.16.2-8
unbound - addressed in versions 1.16.2-7, 1.16.2-8
unbound-devel - addressed in versions 1.16.2-7, 1.16.2-8
unbound - update to 1.17.1-1
Red Hat Migration Toolkit for Applications - update to 7.0.3
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF02

• https://access.redhat.com/security/cve/CVE-2024-1488
• https://bugzilla.redhat.com/show_bug.cgi?id=2264183

• Multiple vulnerabilities in Unbound
• openEuler update for unbound
• Red Hat Enterprise Linux 9 update for unbound
• Red Hat Enterprise Linux 8 update for unbound
• Red Hat Enterprise Linux 9.2 Extended Update Support update for unbound
• Red Hat Enterprise Linux 9.0 Extended Update Support update for unbound
• Red Hat Enterprise Linux 8.8 Extended Update Support update for unbound
• Red Hat Enterprise Linux 8.6 Extended Update Support update for unbound
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh Containers 2.5
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Red Hat Enterprise Linux 8 update for unbound
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in IBM QRadar SIEM
• Red Hat Enterprise Linux 8 update for unbound
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Amazon Linux AMI update for unbound
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Junos Space
• Red Hat Enterprise Linux 8 update for unbound
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Anolis OS update for unbound
• Anolis OS update for unbound
• Juniper Secure Analytics update for third-party components
• Multiple vulnerabilities in Meinberg LANTIME firmware (July 2024)
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0