A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - unbound: command injection with data coming from a specially crafted IPSECKEY answer (CVE-2019-18934)

  - A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An     improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an     existing wildcard record, or trick unbound into accepting a NODATA proof. (CVE-2017-15105)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the version of the unbound package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way unbound before 1.6.8     validated wildcard-synthesized NSEC records. An     improperly validated wildcard NSEC record could be used     to prove the non-existence (NXDOMAIN answer) of an     existing wildcard record, or trick unbound into     accepting a NODATA proof.(CVE-2017-15105)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the unbound package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way unbound validated     wildcard-synthesized NSEC records. An improperly     validated wildcard NSEC record could be used to prove     the non-existence (NXDOMAIN answer) of an existing     wildcard record, or trick unbound into accepting a     NODATA proof.(CVE-2017-15105)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way unbound before 1.6.8     validated wildcard-synthesized NSEC records. An     improperly validated wildcard NSEC record could be used     to prove the non-existence (NXDOMAIN answer) of an     existing wildcard record, or trick unbound into     accepting a NODATA proof.(CVE-2017-15105)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ralph Dolmans and Karst Koymans found a flaw in the way unbound, a validating, recursive, caching DNS resolver, validated wildcard-synthesized NSEC records.

An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.

For more information please refer to the upstream advisory at https://unbound.net/downloads/CVE-2017-15105.txt.

For Debian 8 'Jessie', this problem has been fixed in version 1.4.22-3+deb8u4.

We recommend that you upgrade your unbound packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3673-1 advisory.

    Ralph Dolmans and Karst Koymans discovered that Unbound did not properly handle certain NSEC records. An     attacker could use this to to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or     trick Unbound into accepting a NODATA proof.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2017-15105

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ralph Dolmans and Karst Koymans found a flaw in the way unbound validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.

For more information please refer to the upstream advisory at https://unbound.net/downloads/CVE-2017-15105.txt.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.17-3+deb7u3.

We recommend that you upgrade your unbound packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote Unbound DNS resolver is affected by a validation weakness when handling wildcard synthesized NSEC records.

Unbound reports :

We discovered a vulnerability in the processing of wildcard synthesized NSEC records. While synthesis of NSEC records is allowed by RFC4592, these synthesized owner names should not be used in the NSEC processing. This does, however, happen in Unbound 1.6.7 and earlier versions.

ID	Name	Product	Family	Severity
199950	RHEL 7 : unbound (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
135644	EulerOS Virtualization 3.0.2.2 : unbound (EulerOS-SA-2020-1482)	Nessus	Huawei Local Security Checks	medium
134553	EulerOS Virtualization for ARM 64 3.0.2.0 : unbound (EulerOS-SA-2020-1264)	Nessus	Huawei Local Security Checks	medium
132211	EulerOS 2.0 SP3 : unbound (EulerOS-SA-2019-2676)	Nessus	Huawei Local Security Checks	medium
131641	EulerOS 2.0 SP2 : unbound (EulerOS-SA-2019-2488)	Nessus	Huawei Local Security Checks	medium
131506	EulerOS Virtualization for ARM 64 3.0.3.0 : unbound (EulerOS-SA-2019-2341)	Nessus	Huawei Local Security Checks	medium
130656	EulerOS 2.0 SP5 : unbound (EulerOS-SA-2019-2194)	Nessus	Huawei Local Security Checks	medium
122196	Debian DLA-1676-1 : unbound security update	Nessus	Debian Local Security Checks	medium
110413	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Unbound vulnerability (USN-3673-1)	Nessus	Ubuntu Local Security Checks	medium
106641	Fedora 26 : unbound (2018-a10a19e06a)	Nessus	Fedora Local Security Checks	medium
106515	Fedora 27 : unbound (2018-69316c5b7a)	Nessus	Fedora Local Security Checks	medium
106508	Debian DLA-1264-1 : unbound security update	Nessus	Debian Local Security Checks	medium
106384	Unbound < 1.6.8 Wildcard Synthesized NSEC Records Handling Remote Validation Weakness	Nessus	DNS	medium
106214	FreeBSD : unbound -- vulnerability in the processing of wildcard synthesized NSEC records (8d3bae09-fd28-11e7-95f2-005056925db4)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2017-15105

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium