The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2650 advisory.

    NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with     very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very     large RRsets can cause Unbound to spend a considerable time applying name compression to downstream     replies. This can lead to degraded performance and eventually denial of service in well orchestrated     attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially     crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will     try to apply name compression which was an unbounded operation that could lock the CPU until the whole     packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression     calculations it is willing to do per packet. Packets that need more compression will result in semi-     compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long.
    This change should not affect normal DNS traffic. (CVE-2024-8508)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : unbound (ALAS-2024-2650)

medium Nessus Plugin ID 209144

Version 1.2

Version 1.1

Version 1.2 Oct 25, 2024, 12:46 PM IAVM reference STIG Severity Plugin Feed: 202410251246
Version 1.1 Oct 16, 2024, 7:31 PM New Plugin Feed: 202410161931