SUSE update for unbound



Published: 2024-06-04 | Updated: 2024-08-23
Risk Medium
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2022-30698
CVE-2022-30699
CVE-2022-3204
CVE-2023-50387
CVE-2023-50868
CWE-ID CWE-341
CWE-400
Exploitation vector Network
Public exploit Public exploit code for vulnerability #4 is available.
Public exploit code for vulnerability #5 is available.
Vulnerable software
Subscribe 		SUSE Package Hub 15
Operating systems & Components / Operating system

Basesystem Module
Operating systems & Components / Operating system

SUSE Linux Enterprise Real Time 15
Operating systems & Components / Operating system

openSUSE Leap
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Desktop 15
Operating systems & Components / Operating system

unbound-munin
Operating systems & Components / Operating system package or component

libunbound-devel-mini
Operating systems & Components / Operating system package or component

unbound-python-debuginfo
Operating systems & Components / Operating system package or component

unbound-anchor
Operating systems & Components / Operating system package or component

unbound-python
Operating systems & Components / Operating system package or component

unbound-devel
Operating systems & Components / Operating system package or component

unbound-debuginfo
Operating systems & Components / Operating system package or component

unbound-debugsource
Operating systems & Components / Operating system package or component

unbound-anchor-debuginfo
Operating systems & Components / Operating system package or component

libunbound8-debuginfo
Operating systems & Components / Operating system package or component

libunbound-devel-mini-debuginfo
Operating systems & Components / Operating system package or component

libunbound8
Operating systems & Components / Operating system package or component

unbound
Operating systems & Components / Operating system package or component

libunbound-devel-mini-debugsource
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Predictable from Observable State

EUVDB-ID: #VU66548

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30698

CWE-ID: CWE-341 - Predictable from Observable State

Exploit availability: No

Description

The vulnerability allows a remote attacker to poison DNS cache.

The vulnerability exists due to the way Unbound handles delegation information expiration event. A remote attacker who controls a rouge DNS server can force the Unbound instance to cache incorrect information about subdomain delegation and permanently poison the DNS cache, e.g. perform the "ghost domain names" attack. 

The attack is carried out when Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation.

Mitigation

Update the affected package unbound to the latest version.

Vulnerable software versions

SUSE Package Hub 15: 15-SP6

Basesystem Module: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

unbound-munin: before 1.20.0-150600.23.3.1

libunbound-devel-mini: before 1.20.0-150600.23.3.1

unbound-python-debuginfo: before 1.20.0-150600.23.3.1

unbound-anchor: before 1.20.0-150600.23.3.1

unbound-python: before 1.20.0-150600.23.3.1

unbound-devel: before 1.20.0-150600.23.3.1

unbound-debuginfo: before 1.20.0-150600.23.3.1

unbound-debugsource: before 1.20.0-150600.23.3.1

unbound-anchor-debuginfo: before 1.20.0-150600.23.3.1

libunbound8-debuginfo: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debuginfo: before 1.20.0-150600.23.3.1

libunbound8: before 1.20.0-150600.23.3.1

unbound: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debugsource: before 1.20.0-150600.23.3.1

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20241923-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Predictable from Observable State

EUVDB-ID: #VU66547

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30699

CWE-ID: CWE-341 - Predictable from Observable State

Exploit availability: No

Description

The vulnerability allows a remote attacker to poison DNS cache.

The vulnerability exists due to the way Unbound handles delegation information expiration event. A remote attacker who controls a rouge DNS server can force the Unbound instance to cache incorrect information about domain delegation and permanently poison the DNS cache, e.g. perform the "ghost domain names" attack. 

The attack is perform when Unbound is queried for a rogue domain name, which cached delegation information is about to expire. The rogue nameserver delays the response until the cached delegation information expires. Upon receiving the delayed answer containing the delegation information, Unbound overwrites the now expired entries.

Mitigation

Update the affected package unbound to the latest version.

Vulnerable software versions

SUSE Package Hub 15: 15-SP6

Basesystem Module: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

unbound-munin: before 1.20.0-150600.23.3.1

libunbound-devel-mini: before 1.20.0-150600.23.3.1

unbound-python-debuginfo: before 1.20.0-150600.23.3.1

unbound-anchor: before 1.20.0-150600.23.3.1

unbound-python: before 1.20.0-150600.23.3.1

unbound-devel: before 1.20.0-150600.23.3.1

unbound-debuginfo: before 1.20.0-150600.23.3.1

unbound-debugsource: before 1.20.0-150600.23.3.1

unbound-anchor-debuginfo: before 1.20.0-150600.23.3.1

libunbound8-debuginfo: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debuginfo: before 1.20.0-150600.23.3.1

libunbound8: before 1.20.0-150600.23.3.1

unbound: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debugsource: before 1.20.0-150600.23.3.1

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20241923-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource exhaustion

EUVDB-ID: #VU69407

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3204

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing a malicious delegation with a considerable number of non responsive nameservers. A remote attacker can trigger CPU high usage and perform a denial of service (DoS) attack.

The attack is known as "Non-Responsive Delegation Attack" (NRDelegation Attack).

Mitigation

Update the affected package unbound to the latest version.

Vulnerable software versions

SUSE Package Hub 15: 15-SP6

Basesystem Module: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

unbound-munin: before 1.20.0-150600.23.3.1

libunbound-devel-mini: before 1.20.0-150600.23.3.1

unbound-python-debuginfo: before 1.20.0-150600.23.3.1

unbound-anchor: before 1.20.0-150600.23.3.1

unbound-python: before 1.20.0-150600.23.3.1

unbound-devel: before 1.20.0-150600.23.3.1

unbound-debuginfo: before 1.20.0-150600.23.3.1

unbound-debugsource: before 1.20.0-150600.23.3.1

unbound-anchor-debuginfo: before 1.20.0-150600.23.3.1

libunbound8-debuginfo: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debuginfo: before 1.20.0-150600.23.3.1

libunbound8: before 1.20.0-150600.23.3.1

unbound: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debugsource: before 1.20.0-150600.23.3.1

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20241923-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource exhaustion

EUVDB-ID: #VU86377

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-50387

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.

Mitigation

Update the affected package unbound to the latest version.

Vulnerable software versions

SUSE Package Hub 15: 15-SP6

Basesystem Module: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

unbound-munin: before 1.20.0-150600.23.3.1

libunbound-devel-mini: before 1.20.0-150600.23.3.1

unbound-python-debuginfo: before 1.20.0-150600.23.3.1

unbound-anchor: before 1.20.0-150600.23.3.1

unbound-python: before 1.20.0-150600.23.3.1

unbound-devel: before 1.20.0-150600.23.3.1

unbound-debuginfo: before 1.20.0-150600.23.3.1

unbound-debugsource: before 1.20.0-150600.23.3.1

unbound-anchor-debuginfo: before 1.20.0-150600.23.3.1

libunbound8-debuginfo: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debuginfo: before 1.20.0-150600.23.3.1

libunbound8: before 1.20.0-150600.23.3.1

unbound: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debugsource: before 1.20.0-150600.23.3.1

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20241923-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Resource exhaustion

EUVDB-ID: #VU86378

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-50868

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.

Mitigation

Update the affected package unbound to the latest version.

Vulnerable software versions

SUSE Package Hub 15: 15-SP6

Basesystem Module: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

unbound-munin: before 1.20.0-150600.23.3.1

libunbound-devel-mini: before 1.20.0-150600.23.3.1

unbound-python-debuginfo: before 1.20.0-150600.23.3.1

unbound-anchor: before 1.20.0-150600.23.3.1

unbound-python: before 1.20.0-150600.23.3.1

unbound-devel: before 1.20.0-150600.23.3.1

unbound-debuginfo: before 1.20.0-150600.23.3.1

unbound-debugsource: before 1.20.0-150600.23.3.1

unbound-anchor-debuginfo: before 1.20.0-150600.23.3.1

libunbound8-debuginfo: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debuginfo: before 1.20.0-150600.23.3.1

libunbound8: before 1.20.0-150600.23.3.1

unbound: before 1.20.0-150600.23.3.1

libunbound-devel-mini-debugsource: before 1.20.0-150600.23.3.1

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20241923-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###