Unbound - Wildcard NSEC Record Validation Vulnerability
Summary
DLA-1264-1: unbound - security update. Affects unbound versions < 1.4.17-3+deb7u3. Fixed in 1.4.17-3+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver. It is designed to be fast and secure, providing DNSSEC validation and DNS over TLS support. Unbound is widely used in various systems and applications to handle DNS queries and responses.
Vulnerability Detail
A flaw was discovered in the way unbound validates wildcard-synthesized NSEC records. This vulnerability allows an attacker to exploit improperly validated wildcard NSEC records to prove the non-existence (NXDOMAIN answer) of an existing wildcard record or trick unbound into accepting a NODATA proof. By exploiting this vulnerability, an attacker could potentially manipulate DNS responses and redirect users to malicious websites or intercept sensitive information.
How To Fix
Minimum fixed version
1.4.17-3+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to ensure the integrity and security of DNS resolution.
Conclusion
It is highly recommended to upgrade the unbound package to the fixed version to mitigate the risks associated with this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for unbound →
FAQ
Unbound is a DNS resolver used for validating, recursive, and caching DNS queries.
This vulnerability allows an attacker to manipulate DNS responses and potentially redirect users to malicious websites or intercept sensitive information.
To fix this vulnerability, upgrade the unbound package to version 1.4.17-3+deb7u3 or later.
There is no known workaround for this vulnerability. It is crucial to apply the security update.
More information can be found in the upstream advisory and the Debian LTS security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
