CVE-2019-25042
unbound: out-of-bounds write via a compressed name in rdata_copy
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
** EN DISPUTA ** Unbound versiones anteriores a 1.9.5 permite una escritura fuera de límites por medio de un nombre comprimido en la función rdata_copy. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalación de Unbound en funcionamiento no puede ser explotada de forma remota o local
A flaw was found in unbound. An out-of-bounds write in the rdata_copy function may be abused by a remote attacker. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-04-27 CVE Reserved
- 2021-04-27 CVE Published
- 2024-05-14 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html | Mailing List |
|
| https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results | Not Applicable | |
| https://security.netapp.com/advisory/ntap-20210507-0007 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-25042 | 2022-02-22 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1954804 | 2022-02-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Nlnetlabs Search vendor "Nlnetlabs" | Unbound Search vendor "Nlnetlabs" for product "Unbound" | < 1.9.5 Search vendor "Nlnetlabs" for product "Unbound" and version " < 1.9.5" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||