According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Unbound before 1.10.1 has Insufficient Control of     Network Message Volume, aka an 'NXNSAttack' issue. This     is triggered by random subdomains in the NSDNAME in NS     records.(CVE-2020-12662)

  - Unbound before 1.10.1 has an infinite loop via     malformed DNS answers received from upstream     servers.(CVE-2020-12663)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

NLNetLabs reports :

This release fixes CVE-2020-12662 and CVE-2020-12663.

Bug Fixes :

- CVE-2020-12662 Unbound can be tricked into amplifying an incoming query into a large number of queries directed to a target.

- CVE-2020-12663 Malformed answers from upstream name servers can be used to make Unbound unresponsive.

Security fix for CVE-2020-12662 and CVE-2020-12663

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Unbound incorrectly handled certain queries. A remote attacker could use this issue to perform an amplification attack directed at a target. (CVE-2020-12662)

It was discovered that Unbound incorrectly handled certain malformed answers. A remote attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service. (CVE-2020-12663).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A network amplification vulnerability was found in Unbound, in the way it processes delegation messages from one authoritative zone to another. This flaw allows an attacker to cause a denial of service or be part of an attack against another DNS server when Unbound is deployed as a recursive resolver or authoritative name server.(CVE-2020-12662)

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers.(CVE-2020-12663)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2414 advisory.

  - unbound: amplification of an incoming query into a large     number of queries directed to a target (CVE-2020-12662)

  - unbound: infinite loop via malformed DNS answers     received from upstream servers (CVE-2020-12663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - unbound: amplification of an incoming query into a large     number of queries directed to a target (CVE-2020-12662)

  - unbound: infinite loop via malformed DNS answers     received from upstream servers (CVE-2020-12663)

An update of the unbound package has been released.

According to the versions of the unbound package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in unbound in versions prior to     1.10.1. An infinite loop can be created when malformed     DNS answers are received from upstream servers. The     highest threat from this vulnerability is to system     availability.(CVE-2020-12663)

  - A network amplification vulnerability was found in     Unbound, in the way it processes delegation messages     from one authoritative zone to another. This flaw     allows an attacker to cause a denial of service or be     part of an attack against another DNS server when     Unbound is deployed as a recursive resolver or     authoritative name server.(CVE-2020-12662)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Unbound before 1.10.1 has an infinite loop via     malformed DNS answers received from upstream     servers.(CVE-2020-12663)

  - Unbound before 1.10.1 has Insufficient Control of     Network Message Volume, aka an 'NXNSAttack' issue. This     is triggered by random subdomains in the NSDNAME in NS     records.(CVE-2020-12662)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities have been corrected in unbound, a validating, recursive, caching DNS resolver. Support for the unbound DNS server has been resumed, the sources can be found in the unbound1.9 source package.

CVE-2020-12662

Unbound has Insufficient Control of Network Message Volume, aka an 'NXNSAttack' issue. This is triggered by random subdomains in the NSDNAME in NS records.

CVE-2020-12663

Unbound has an infinite loop via malformed DNS answers received from upstream servers.

CVE-2020-28935

Unbound contains a local vulnerability that would allow for a local symlink attack. When writing the PID file Unbound creates the file if it is not there, or opens an existing file for writing. In case the file was already present, it would follow symlinks if the file happened to be a symlink instead of a regular file. 

For Debian 9 stretch, these problems have been fixed in version 1.9.0-2+deb10u2~deb9u1.

We recommend that you upgrade your unbound1.9 packages.

For the detailed security status of unbound1.9 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/unbound1.9

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
139160	EulerOS 2.0 SP8 : unbound (EulerOS-SA-2020-1830)	Nessus	Huawei Local Security Checks	7/30/2020	2/27/2024	high
136852	FreeBSD : unbound -- mutliple vulnerabilities (a2cb7c31-9c79-11ea-a9c2-d05099c0ae8c)	Nessus	FreeBSD Local Security Checks	5/26/2020	3/8/2024	high
136937	Fedora 31 : unbound (2020-8e9b62948e)	Nessus	Fedora Local Security Checks	5/28/2020	3/8/2024	high
136943	Ubuntu 18.04 LTS / 20.04 LTS : Unbound vulnerabilities (USN-4374-1)	Nessus	Ubuntu Local Security Checks	5/28/2020	10/20/2023	high
137096	Amazon Linux AMI : unbound (ALAS-2020-1373)	Nessus	Amazon Linux Local Security Checks	6/4/2020	3/8/2024	high
137111	Fedora 32 : unbound (2020-3cfd38fefd)	Nessus	Fedora Local Security Checks	6/4/2020	3/8/2024	high
137281	CentOS 7 : unbound (CESA-2020:2414)	Nessus	CentOS Local Security Checks	6/10/2020	3/7/2024	high
137294	Scientific Linux Security Update : unbound on SL7.x x86_64 (20200609)	Nessus	Scientific Linux Local Security Checks	6/10/2020	3/7/2024	high
137329	Photon OS 2.0: Unbound PHSA-2020-2.0-0246	Nessus	PhotonOS Local Security Checks	6/11/2020	6/17/2020	high
140341	EulerOS Virtualization for ARM 64 3.0.2.0 : unbound (EulerOS-SA-2020-1971)	Nessus	Huawei Local Security Checks	9/8/2020	2/21/2024	high
142538	EulerOS Virtualization 3.0.6.6 : unbound (EulerOS-SA-2020-2454)	Nessus	Huawei Local Security Checks	11/6/2020	1/6/2021	high
146527	Debian DLA-2556-1 : unbound1.9 security update	Nessus	Debian Local Security Checks	2/16/2021	1/22/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high