CVSS: 7.5EPSS: 1%CPEs: 10EXPL: 0CVE-2020-12662 – unbound: amplification of an incoming query into a large number of queries directed to a target
https://notcve.org/view.php?id=CVE-2020-12662
Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records. Unbound versiones anteriores a 1.10.1, presenta un Control Insuficiente del Volumen de Mensajes de Red, también se conoce como un problema de "NXNSAttack". Esto es activado por subdominios aleatorios en NSDNAME en registros NS. A network amplification vulnerability was found in Unbound, in the way it processes delegation messages from one authoritative zone to another. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html http://www.nxnsattack.com http://www.openwall.com/lists/oss-security/2020/05/19/5 https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/ • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 1%CPEs: 10EXPL: 0CVE-2020-12663 – unbound: infinite loop via malformed DNS answers received from upstream servers
https://notcve.org/view.php?id=CVE-2020-12663
Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Unbound versiones anteriores a 1.10.1, presenta un bucle infinito mediante respuestas DNS malformadas recibidas desde servidores aguas arriba. A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html http://www.openwall.com/lists/oss-security/2020/05/19/5 https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ42N2HBZ3DXMSEC56SWIIOFQGOS5M7I h • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.3EPSS: 0%CPEs: 4EXPL: 1CVE-2019-18934 – unbound: command injection with data coming from a specially crafted IPSECKEY answer
https://notcve.org/view.php?id=CVE-2019-18934
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with `--enable-ipsecmod` support, and ipsecmod is enabled and used in the configuration. Unbound versiones 1.6.4 hasta 1.9.4, contiene una vulnerabilidad en el módulo ipsec que puede causar una ejecución de código de shell después de recibir una respuesta especialmente diseñada. Este problema solo puede ser activado si unbound fue compilado con el soporte "--enable-ipsecmod", e ipsecmod está habilitado y usado en la configuración. A shell command injection vulnerability was discovered in the way unbound handles DNS queries for systems with a public key used for IPsec. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html http://www.openwall.com/lists/oss-security/2019/11/19/1 https://github.com/NLnetLabs/unbound/blob/release-1.9.5/doc/Changelog https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCR6JP7MSRARTOGEHGST64G4FJGX5VK https://www.nlnetlabs.nl/downloads/unbound/CVE-2019-18934.txt https://www.nlnetlabs.nl/news/2019/No • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2013-5661
https://notcve.org/view.php?id=CVE-2013-5661
Cache Poisoning issue exists in DNS Response Rate Limiting. Existe Un problema de envenenamiento de caché en el DNS Response Rate Limiting. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5661 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-5661 https://security-tracker.debian.org/tracker/CVE-2013-5661 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 7.5EPSS: 18%CPEs: 2EXPL: 0CVE-2019-16866
https://notcve.org/view.php?id=CVE-2019-16866
Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule. Unbound versiones anteriores a 1.9.4, accede a la memoria no inicializada, lo que permite a atacantes remotos desencadenar un bloqueo por medio de una consulta NOTIFY diseñada. La dirección IP del origen de la consulta debe coincidir con una regla de control de acceso. • https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt https://seclists.org/bugtraq/2019/Oct/23 https://usn.ubuntu.com/4149-1 https://www.debian.org/security/2019/dsa-4544 • CWE-755: Improper Handling of Exceptional Conditions CWE-908: Use of Uninitialized Resource •