Out-of-Bounds Write Vulnerability in Unbound
Summary
CVE-2019-25035: Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. Affects unbound across 2 version ranges.
< 1.9.6-1
< 34e52a4313d59b9d57e928c44300fd81e1a48910
Fixed in 1.9.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is an open-source DNS resolver that is widely used for secure and efficient DNS resolution. It provides a range of features and is known for its high performance and reliability. However, a vulnerability has been discovered in Unbound that allows an out-of-bounds write in the sldns_bget_token_par function. This vulnerability can potentially be exploited to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2019-25035, occurs due to an out-of-bounds write in the sldns_bget_token_par function of Unbound. This function is responsible for parsing DNS messages. An attacker can exploit this vulnerability by sending a specially crafted DNS message, leading to a buffer overflow and potentially allowing them to execute arbitrary code or crash the Unbound service. The impact of this vulnerability can be severe, as it can compromise the integrity and availability of the DNS resolution process.
How To Fix
Minimum fixed version
1.9.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating Unbound to the latest version.
Conclusion
The out-of-bounds write vulnerability in Unbound can have severe consequences, including the potential execution of arbitrary code or denial of service. It is crucial for users to update their Unbound installations to the latest version to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for unbound →
FAQ
Unbound is an open-source DNS resolver that provides secure and efficient DNS resolution.
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service by exploiting an out-of-bounds write issue in Unbound.
To fix this vulnerability, update Unbound to version 1.9.6-1 or later.
No, there is no known workaround for this vulnerability. Updating Unbound to the latest version is the recommended solution.
You can find more information about this vulnerability in the CVE-2019-25035 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
