Resource management error in Unbound - CVE-2024-33655

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU89361

Resource management error in Unbound - CVE-2024-33655

Published: May 12, 2024


Vulnerability identifier: #VU89361
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-33655
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to way Unbound queues DNS requests, which makes it susceptible to DNSBomb attack. A remote attacker with ability to control the delay of the malicious authoritative answers can force Unbound to slowly accumulate pending answers for the spoofed addresses. When the authoritative answers become available to Unbound at the same time, Unbound starts serving all the accumulated queries. This results in large-sized, concentrated response bursts to the spoofed addresses.

Unbound itself is not vulnerable for DoS, rather it can be used to take part in a pulsing DoS amplification attack.


Affected software

Unbound
Amazon Linux AMI
Debian Linux
openEuler
Ubuntu
Anolis OS
Fedora
unbound
libunbound8 (Ubuntu package)
unbound (Ubuntu package)
unbound-devel
unbound-debugsource
unbound-debuginfo
python3-unbound
unbound-help
unbound-libs
unbound-anchor
unbound (Debian package)
unbound-utils

How to mitigate CVE-2024-33655

Install updates from vendor's website.

Unbound - update to 1.20.0
unbound - addressed in versions 1.6.6-1.6, 1.17.1-1
libunbound8 (Ubuntu package) - addressed in versions 1.9.4-2ubuntu1.6, 1.13.1-1ubuntu5.5, 1.17.1-2ubuntu0.2, 1.19.2-1ubuntu3.1
unbound (Ubuntu package) - addressed in versions 1.9.4-2ubuntu1.6, 1.13.1-1ubuntu5.5, 1.17.1-2ubuntu0.2, 1.19.2-1ubuntu3.1
unbound-devel - addressed in versions 1.11.0-15, 1.13.2-14, 1.13.2-15
unbound-debugsource - addressed in versions 1.11.0-15, 1.13.2-14, 1.13.2-15
unbound-debuginfo - addressed in versions 1.11.0-15, 1.13.2-14, 1.13.2-15
python3-unbound - addressed in versions 1.11.0-15, 1.13.2-14, 1.13.2-15
unbound - addressed in versions 1.11.0-15, 1.13.2-14, 1.13.2-15
unbound-help - addressed in versions 1.11.0-15, 1.13.2-14, 1.13.2-15
unbound-libs - addressed in versions 1.11.0-15, 1.13.2-14, 1.13.2-15
unbound-anchor - update to 1.13.2-15
unbound (Debian package) - update to 1.17.1-2+deb12u3
python3-unbound - update to 1.17.1-3
unbound - update to 1.17.1-3
unbound-anchor - update to 1.17.1-3
unbound-devel - update to 1.17.1-3
unbound-libs - update to 1.17.1-3
unbound-utils - update to 1.17.1-3
unbound - addressed in versions 1.20.0-1.fc39, 1.20.0-1.fc40

External References

Related Security Bulletins