Bug 1837597 (CVE-2020-12662)
| Summary: | CVE-2020-12662 unbound: amplification of an incoming query into a large number of queries directed to a target | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | Petr Sklenar <psklenar> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aegorenk, akhaitov, pemensik, pj.pandit, psklenar, pwouters, rschiron, uwe.knop |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | unbound 1.10.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A network amplification vulnerability was found in Unbound, in the way it processes delegation messages from one authoritative zone to another. This flaw allows an attacker to cause a denial of service or be part of an attack against another DNS server when Unbound is deployed as a recursive resolver or authoritative name server.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-06-08 11:20:27 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1837598, 1839171, 1839172, 1839174, 1839175, 1839176, 1839177, 1839178, 1879514 | ||
| Bug Blocks: | 1837616 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-05-19 17:36:09 UTC
Created unbound tracking bugs for this issue: Affects: fedora-all [bug 1837598] The attack model of this attack involves: one or more DNS clients on the Internet (either directly controlled by the attacker or e.g. through a botnet), an attacker-controlled authoritative DNS system (either bought or a legitimate compromised one) and a regular recursive resolver. During the DNS resolution process to resolve name xxx.yyyy.zzz, an authoritative name server for e.g. .yyyy.zzz can return a list of names that could help in the resolution of the original request. For each of these new names, Unbound checks whether it is already in cache, otherwise it starts a new resolution process to find out its IP address. Due to the attacker controlling an authoritative DNS system, he can make the server respond to such queries with a long list of non-existent name servers, bypassing the cache system and creating additional queries starting from the recursive resolver. Depending on the non-existent name servers returned, it is possible to perform 3 kinds of attacks: 1) a recursive resolver attack, which forces the victim recursive resolver to processes a large amount of packets for each two packets the attacker components generate (claimed bandwitdth amplification is 132x) 2) an authoritative Second Level Domain(SLD) attack, where all the name servers in the malicious reply of the attacker controlled name server are sub-domains of a victim SLD (claimed bandwidth amplification is 21x) 3) ROOT/Top Level Domain (TLD) attack, which uses the self delegations technique to increase the number of concurrent referrals to the ROOT name-servers. External References: https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt http://www.nxnsattack.com/ Raising the Impact to Important as, according to our Severity ratings, this flaw allows remote users to cause a denial of service. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:2414 https://access.redhat.com/errata/RHSA-2020:2414 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:2416 https://access.redhat.com/errata/RHSA-2020:2416 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:2418 https://access.redhat.com/errata/RHSA-2020:2418 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:2419 https://access.redhat.com/errata/RHSA-2020:2419 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-12662 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2020:2640 https://access.redhat.com/errata/RHSA-2020:2640 Removing needinfo as the bug is resolved This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Extended Update Support Via RHSA-2020:4181 https://access.redhat.com/errata/RHSA-2020:4181 |