Unbound Security Update: Incorrect Default Permissions
Summary
ALSA-2024:1751: Important: unbound security update. Affects python3-unbound versions < 1.16.2-5.el8_9.6. Fixed in 1.16.2-5.el8_9.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver. It is responsible for resolving domain names and ensuring the security and integrity of DNS queries. The package provides essential functionality for network communication and is widely used in various systems and applications.
Vulnerability Detail
The vulnerability in Unbound arises from incorrect default permissions, which allow any process outside the unbound group to modify the unbound runtime configuration. This flaw can be exploited when the combination of the "control-use-cert: no" option and either explicit or implicit use of an IP address in the "control-interface" option is present. An unprivileged local process can connect over localhost to port 8953 and manipulate the running instance of Unbound. This manipulation can lead to altering forwarders, tracking all queries forwarded by the local resolver, and potentially disrupting resolving altogether.
How To Fix
Minimum fixed version
1.16.2-5.el8_9.6
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Unbound security update addresses a vulnerability that allows unauthorized modification of the runtime configuration. It is crucial to update to the latest version and follow the recommended steps to secure your Unbound installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3-unbound →
FAQ
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver. It is responsible for resolving domain names and ensuring the security and integrity of DNS queries.
The vulnerability arises from incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration.
An attacker can exploit this vulnerability to alter the configuration of Unbound, potentially disrupting resolving, tracking queries, and manipulating forwarders.
You can use the command "unbound-control status | grep control" to check if your configuration is vulnerable. If the output contains "control(ssl)" or "control(namedpipe)", your configuration is not vulnerable.
To fix your configuration, add the line "include: /etc/unbound/conf.d/remote-control.conf" to the end of the file "/etc/unbound/unbound.conf". If you use a custom "/etc/unbound/conf.d/remote-control.conf" file, add the new directives to that file.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
