Denial of Service Vulnerability in Unbound DNS Resolver
Summary
DEBIAN-CVE-2011-4869: validator/val_nsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service (daemon crash) via a malformed response tha... Affects unbound versions < 1.4.14-1. Fixed in 1.4.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver designed for high performance and security. It is widely used in various environments to ensure reliable DNS resolution. However, prior to version 1.4.14-1, Unbound contained a vulnerability that could be exploited by remote DNS servers, leading to potential service disruptions.
Vulnerability Detail
The vulnerability, identified as CVE-2011-4869, originates from improper proof processing in the validator component of Unbound, specifically in the val_nsec3.c file. This flaw allows remote DNS servers to send malformed responses that lack expected NSEC3 records, resulting in a denial of service condition where the Unbound daemon crashes. This issue poses a significant risk as it can disrupt DNS services, affecting all clients relying on the resolver.
How To Fix
Minimum fixed version
1.4.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider configuring your DNS resolver to ignore responses that do not conform to expected NSEC3 records. However, this is not a permanent solution and updating the package is highly recommended.
Conclusion
In summary, CVE-2011-4869 is a significant vulnerability in the Unbound DNS resolver that can lead to denial of service attacks. It is crucial to update to the patched version 1.4.14-1 to mitigate this risk. Regular monitoring and timely updates are essential for maintaining the security of your systems.
See every vulnerability recorded for unbound →
FAQ
CVE-2011-4869 is a vulnerability in Unbound that allows remote DNS servers to cause a denial of service by sending malformed responses.
You can check your version of Unbound by running 'unbound -V' in your terminal. If it is below 1.4.14-1, it is affected.
Exploiting this vulnerability can lead to the Unbound daemon crashing, resulting in service interruptions for all clients relying on it for DNS resolution.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring code access.
You can find more information about CVE-2011-4869 in the official Debian security advisories or on vulnerability databases.
References
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
