Integer Overflow in Unbound dnscrypt.c
Summary
CVE-2019-25038: Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. Affects unbound across 2 version ranges.
< 1.9.6-1
< 34e52a4313d59b9d57e928c44300fd81e1a48910
Fixed in 1.9.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is an open-source DNS resolver that provides secure and fast DNS resolution. It is widely used in various operating systems and distributions. The dnscrypt.c file in Unbound is responsible for handling DNSCrypt protocol requests. DNSCrypt is a protocol that encrypts DNS traffic to enhance privacy and security. However, a vulnerability exists in the size calculation of dnscrypt.c, leading to an integer overflow.
Vulnerability Detail
The vulnerability (CVE-2019-25038) in Unbound's dnscrypt.c allows an attacker to trigger an integer overflow during a size calculation. This vulnerability can be exploited to cause a denial-of-service (DoS) condition or potentially execute arbitrary code. The issue arises due to improper input validation, allowing an attacker to provide a maliciously crafted input that triggers the overflow. Although the vendor disputes the severity of this vulnerability, it is important to note that a running Unbound installation can be impacted.
How To Fix
Minimum fixed version
1.9.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to update Unbound to the fixed version to mitigate the risk of exploitation.
Conclusion
The integer overflow vulnerability in Unbound's dnscrypt.c can lead to a denial-of-service condition or potential execution of arbitrary code. It is crucial to update Unbound to version 1.9.6-1 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for unbound →
FAQ
Unbound is an open-source DNS resolver that provides secure and fast DNS resolution.
The vulnerability can lead to a denial-of-service (DoS) condition or potential execution of arbitrary code.
Update Unbound to version 1.9.6-1 or later.
No, it is recommended to update Unbound to the fixed version.
The vendor disputes remote exploitation, but it is still important to update Unbound to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
