Denial of Service Vulnerability in Unbound DNS Resolver
Summary
DEBIAN-CVE-2011-4528: Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted respons... Affects unbound versions < 1.4.14-1. Fixed in 1.4.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver designed for high performance and security. It is widely used in various environments to provide DNS services. The package is known for its ability to handle DNS queries efficiently while ensuring data integrity through DNSSEC. However, a vulnerability was discovered that affects its stability when processing certain DNS responses.
Vulnerability Detail
Unbound versions prior to 1.4.13p2 contain a vulnerability that allows remote DNS servers to cause a denial of service by sending crafted responses containing duplicate CNAME records. This flaw arises from the improper handling of unallocated memory during the processing of these records, leading to potential crashes of the Unbound daemon. The impact of this vulnerability can result in service interruptions, affecting any applications relying on the DNS resolver for name resolution.
How To Fix
Minimum fixed version
1.4.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can configure your DNS server to ignore responses that contain duplicate CNAME records. However, this is not a permanent solution, and updating the package is strongly recommended.
Conclusion
The vulnerability in Unbound poses a significant risk of denial of service due to improper memory handling. It is crucial for users to update their installations to the patched version to ensure continued reliability and security of their DNS services.
See every vulnerability recorded for unbound →
FAQ
Unbound versions prior to 1.4.13p2 are affected by this vulnerability.
The vulnerability can lead to a denial of service, causing the Unbound daemon to crash and interrupting DNS services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While the best solution is to update, you can configure your DNS server to ignore responses with duplicate CNAME records as a temporary workaround.
More details can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-4528.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.