Bug 1172065 (CVE-2014-8602) - CVE-2014-8602 unbound: specially crafted request can lead to denial of service
Summary: CVE-2014-8602 unbound: specially crafted request can lead to denial of service
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-8602
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1172066 1172067 1253961
Blocks: 1172068 1210268
TreeView+ depends on / blocked
 
Reported: 2014-12-09 10:23 UTC by Vasyl Kaigorodov
Modified: 2021-02-17 05:55 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A denial of service flaw was found in unbound that an attacker could use to trick the unbound resolver into following an endless loop of delegations, consuming an excessive amount of resources.
Clone Of:
Environment:
Last Closed: 2015-11-20 04:30:06 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2455 0 normal SHIPPED_LIVE Low: unbound security and bug fix update 2015-11-19 11:44:17 UTC

Description Vasyl Kaigorodov 2014-12-09 10:23:02 UTC 
It was reported [1] that unbound resolver can be tricked into following an endless series of delegations, this consumes a lot of resources.
A patch is available that limits the number of fetches performed for a query [2].

According to the timestamps on https://unbound.net/downloads/, this is fixed in https://unbound.net/downloads/unbound-latest.tar.gz
No official release was made though.

[1]: https://unbound.net/downloads/CVE-2014-8602.txt
[2]: http://unbound.net/downloads/patch_cve_2014_8602.diff
Comment 1 Vasyl Kaigorodov 2014-12-09 10:23:32 UTC 
Created unbound tracking bugs for this issue:

Affects: fedora-all [bug 1172066]
Affects: epel-all [bug 1172067]
Comment 4 Tomas Hoger 2014-12-12 20:14:13 UTC 
Advisory from the original reporter ANSSI, the French Network and Information Security Agency:

http://www.ssi.gouv.fr/en/the-anssi/events/vulnerabilty-disclosure-the-infinitely-delegating-name-servers-idns-attack.html
Comment 5 Fedora Update System 2014-12-20 08:36:48 UTC 
unbound-1.5.1-2.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2014-12-20 08:46:35 UTC 
unbound-1.5.1-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Tomáš Hozza 2015-08-13 22:57:32 UTC 
Please note that Unbound will be updated in 7.2 with normal Erratum, since we were not able to synch all changes with RCM for FasTrack Erratum. It may make sense to include the fix there.

Also we will be adding Unbound into el6, but I'll make sure the fix is already included before adding the package.
Comment 12 Huzaifa S. Sidhpurwala 2015-08-17 07:13:10 UTC 
Statement:

(none)
Comment 17 errata-xmlrpc 2015-11-19 14:46:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2455 https://rhn.redhat.com/errata/RHSA-2015-2455.html
Note You need to log in before you can comment on or make changes to this bug.