Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1172065 - (CVE-2014-8602) CVE-2014-8602 unbound: specially crafted request can lead to denial of service
CVE-2014-8602 unbound: specially crafted request can lead to denial of service
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20141208,reported=2...
: Security
Depends On: 1172066 1172067 1253961
Blocks: 1172068 1210268
  Show dependency tree / graph
 
Reported: 2014-12-09 05:23 EST by Vasyl Kaigorodov
Modified: 2015-11-23 06:44 EST (History)
12 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A denial of service flaw was found in unbound that an attacker could use to trick the unbound resolver into following an endless loop of delegations, consuming an excessive amount of resources.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-19 23:30:06 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2455 normal SHIPPED_LIVE Low: unbound security and bug fix update 2015-11-19 06:44:17 EST

  None (edit)
Description Vasyl Kaigorodov 2014-12-09 05:23:02 EST 
It was reported [1] that unbound resolver can be tricked into following an endless series of delegations, this consumes a lot of resources.
A patch is available that limits the number of fetches performed for a query [2].

According to the timestamps on https://unbound.net/downloads/, this is fixed in https://unbound.net/downloads/unbound-latest.tar.gz
No official release was made though.

[1]: https://unbound.net/downloads/CVE-2014-8602.txt
[2]: http://unbound.net/downloads/patch_cve_2014_8602.diff
Comment 1 Vasyl Kaigorodov 2014-12-09 05:23:32 EST 
Created unbound tracking bugs for this issue:

Affects: fedora-all [bug 1172066]
Affects: epel-all [bug 1172067]
Comment 4 Tomas Hoger 2014-12-12 15:14:13 EST 
Advisory from the original reporter ANSSI, the French Network and Information Security Agency:

http://www.ssi.gouv.fr/en/the-anssi/events/vulnerabilty-disclosure-the-infinitely-delegating-name-servers-idns-attack.html
Comment 5 Fedora Update System 2014-12-20 03:36:48 EST 
unbound-1.5.1-2.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2014-12-20 03:46:35 EST 
unbound-1.5.1-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Tomáš Hozza 2015-08-13 18:57:32 EDT 
Please note that Unbound will be updated in 7.2 with normal Erratum, since we were not able to synch all changes with RCM for FasTrack Erratum. It may make sense to include the fix there.

Also we will be adding Unbound into el6, but I'll make sure the fix is already included before adding the package.
Comment 12 Huzaifa S. Sidhpurwala 2015-08-17 03:13:10 EDT 
Statement:

(none)
Comment 17 errata-xmlrpc 2015-11-19 09:46:03 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2455 https://rhn.redhat.com/errata/RHSA-2015-2455.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.