It was reported [1] that unbound resolver can be tricked into following an endless series of delegations, this consumes a lot of resources. A patch is available that limits the number of fetches performed for a query [2]. According to the timestamps on https://unbound.net/downloads/, this is fixed in https://unbound.net/downloads/unbound-latest.tar.gz No official release was made though. [1]: https://unbound.net/downloads/CVE-2014-8602.txt [2]: http://unbound.net/downloads/patch_cve_2014_8602.diff
Created unbound tracking bugs for this issue: Affects: fedora-all [bug 1172066] Affects: epel-all [bug 1172067]
Advisory from the original reporter ANSSI, the French Network and Information Security Agency: http://www.ssi.gouv.fr/en/the-anssi/events/vulnerabilty-disclosure-the-infinitely-delegating-name-servers-idns-attack.html
unbound-1.5.1-2.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
unbound-1.5.1-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Please note that Unbound will be updated in 7.2 with normal Erratum, since we were not able to synch all changes with RCM for FasTrack Erratum. It may make sense to include the fix there. Also we will be adding Unbound into el6, but I'll make sure the fix is already included before adding the package.
Statement: (none)
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2455 https://rhn.redhat.com/errata/RHSA-2015-2455.html