Bug 1172065 (CVE-2014-8602)

Summary:	CVE-2014-8602 unbound: specially crafted request can lead to denial of service
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fweimer, huzaifas, jrusnack, mdshaikh, pj.pandit, psimerda, pwouters, redhat-bugzilla, rskvaril, thozza, vkaigoro, vonsch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A denial of service flaw was found in unbound that an attacker could use to trick the unbound resolver into following an endless loop of delegations, consuming an excessive amount of resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-20 04:30:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1172066, 1172067, 1253961
Bug Blocks:	1172068, 1210268

Description Vasyl Kaigorodov 2014-12-09 10:23:02 UTC

It was reported [1] that unbound resolver can be tricked into following an endless series of delegations, this consumes a lot of resources.
A patch is available that limits the number of fetches performed for a query [2].

According to the timestamps on https://unbound.net/downloads/, this is fixed in https://unbound.net/downloads/unbound-latest.tar.gz
No official release was made though.

[1]: https://unbound.net/downloads/CVE-2014-8602.txt
[2]: http://unbound.net/downloads/patch_cve_2014_8602.diff

Comment 1 Vasyl Kaigorodov 2014-12-09 10:23:32 UTC

Created unbound tracking bugs for this issue:

Affects: fedora-all [bug 1172066]
Affects: epel-all [bug 1172067]

Comment 4 Tomas Hoger 2014-12-12 20:14:13 UTC

Advisory from the original reporter ANSSI, the French Network and Information Security Agency:

http://www.ssi.gouv.fr/en/the-anssi/events/vulnerabilty-disclosure-the-infinitely-delegating-name-servers-idns-attack.html

Comment 5 Fedora Update System 2014-12-20 08:36:48 UTC

unbound-1.5.1-2.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2014-12-20 08:46:35 UTC

unbound-1.5.1-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Tomáš Hozza 2015-08-13 22:57:32 UTC

Please note that Unbound will be updated in 7.2 with normal Erratum, since we were not able to synch all changes with RCM for FasTrack Erratum. It may make sense to include the fix there.

Also we will be adding Unbound into el6, but I'll make sure the fix is already included before adding the package.

Comment 12 Huzaifa S. Sidhpurwala 2015-08-17 07:13:10 UTC

Statement:

(none)

Comment 17 errata-xmlrpc 2015-11-19 14:46:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2455 https://rhn.redhat.com/errata/RHSA-2015-2455.html