Detections
Analytics

EulerOS 2.0 SP12 : unbound (EulerOS-SA-2024-2943)

high Nessus Plugin ID 212623

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi- compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long.
 This change should not affect normal DNS traffic.(CVE-2024-8508)

 A DNSBomb flaw was found in the unbound package. The DNSBomb attack works by sending low-rate spoofed queries for a malicious zone to Unbound. By controlling the delay of the malicious authoritative answers, Unbound slowly accumulates pending answers for the spoofed addresses. When the authoritative answers become available to Unbound at the same time, Unbound starts serving all the accumulated queries. This results in large-sized, concentrated response bursts to the spoofed addresses.(CVE-2024-33655)

Tenable has extracted the preceding description block directly from the EulerOS unbound security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected unbound packages.

See Also

http://www.nessus.org/u?11fcd872

Plugin Details

Severity: High

ID: 212623

File Name: EulerOS_SA-2024-2943.nasl

Version: 1.1

Type: local

Published: 12/12/2024

Updated: 12/12/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2024-33655

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:huawei:euleros:python3-unbound, p-cpe:/a:huawei:euleros:unbound-libs, p-cpe:/a:huawei:euleros:unbound, cpe:/o:huawei:euleros:2.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp

Excluded KB Items: Host/EulerOS/uvp_version

Exploit Ease: No known exploits are available

Patch Publication Date: 12/11/2024

Vulnerability Publication Date: 5/9/2024

Reference Information

CVE: CVE-2024-33655, CVE-2024-8508

IAVA: 2024-A-0682