Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records. References: http://www.openwall.com/lists/oss-security/2020/05/19/5 https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt http://www.nxnsattack.com
Created unbound tracking bugs for this issue: Affects: fedora-all [bug 1837598]
Upstream fix: https://github.com/NLnetLabs/unbound/commit/ba0f382eee814e56900a535778d13206b86b6d49
The attack model of this attack involves: one or more DNS clients on the Internet (either directly controlled by the attacker or e.g. through a botnet), an attacker-controlled authoritative DNS system (either bought or a legitimate compromised one) and a regular recursive resolver. During the DNS resolution process to resolve name xxx.yyyy.zzz, an authoritative name server for e.g. .yyyy.zzz can return a list of names that could help in the resolution of the original request. For each of these new names, Unbound checks whether it is already in cache, otherwise it starts a new resolution process to find out its IP address. Due to the attacker controlling an authoritative DNS system, he can make the server respond to such queries with a long list of non-existent name servers, bypassing the cache system and creating additional queries starting from the recursive resolver. Depending on the non-existent name servers returned, it is possible to perform 3 kinds of attacks: 1) a recursive resolver attack, which forces the victim recursive resolver to processes a large amount of packets for each two packets the attacker components generate (claimed bandwitdth amplification is 132x) 2) an authoritative Second Level Domain(SLD) attack, where all the name servers in the malicious reply of the attacker controlled name server are sub-domains of a victim SLD (claimed bandwidth amplification is 21x) 3) ROOT/Top Level Domain (TLD) attack, which uses the self delegations technique to increase the number of concurrent referrals to the ROOT name-servers.
External References: https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt http://www.nxnsattack.com/
Raising the Impact to Important as, according to our Severity ratings, this flaw allows remote users to cause a denial of service.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:2414 https://access.redhat.com/errata/RHSA-2020:2414
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:2416 https://access.redhat.com/errata/RHSA-2020:2416
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:2418 https://access.redhat.com/errata/RHSA-2020:2418
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:2419 https://access.redhat.com/errata/RHSA-2020:2419
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-12662
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2020:2640 https://access.redhat.com/errata/RHSA-2020:2640
Removing needinfo as the bug is resolved
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Extended Update Support Via RHSA-2020:4181 https://access.redhat.com/errata/RHSA-2020:4181