Critical Security Update for Unbound DNS Resolver - Local Privilege Escalation and Denial of Service Vulnerabilities
Summary
ALSA-2025:0837: Important: unbound security update. Affects python3-unbound versions < 1.16.2-5.8.el8_10. Fixed in 1.16.2-5.8.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance. It is designed to enhance DNS security and efficiency, making it a crucial component in many network infrastructures. However, recent vulnerabilities have been identified that could compromise its integrity and the systems relying on it.
Vulnerability Detail
The identified vulnerabilities in Unbound include unrestricted reconfiguration that allows any user to modify settings, potentially leading to local privilege escalation (CVE-2024-1488). Additionally, unbounded name compression can be exploited to cause a Denial of Service (CVE-2024-8508), disrupting service availability. These vulnerabilities stem from flaws in the software's handling of DNS requests and configurations, posing significant risks to system security and uptime.
How To Fix
Minimum fixed version
1.16.2-5.8.el8_10
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Unbound configuration files and limit user permissions to mitigate the risk of unauthorized reconfiguration. This can be done by modifying file permissions using the following command:
sudo chmod 600 /etc/unbound/unbound.conf
This command ensures that only the root user can read or modify the configuration file.
Conclusion
The recent vulnerabilities in Unbound pose significant risks, including local privilege escalation and Denial of Service. It is crucial to update to the patched versions of the affected packages to mitigate these risks. Implementing workarounds can provide temporary relief while ensuring that your systems remain secure.
See every vulnerability recorded for python3-unbound →
FAQ
The vulnerabilities can lead to local privilege escalation and Denial of Service, potentially allowing unauthorized users to gain elevated access or disrupt DNS services.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, implement the suggested workarounds to restrict access to configuration files and limit user permissions until you can apply the updates.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by malicious actors to gain unauthorized access or disrupt services.
It is recommended to regularly check for vulnerabilities, especially after updates or changes to your software environment, to ensure ongoing security.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
