#VU53023 Code injection in Unbound - CVE-2019-25031

Vulnerability identifier: #VU53023

Vulnerability risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-25031

CWE-ID: CWE-74

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Unbound
Server applications / DNS servers

Vendor: NLnet Labs

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper input validation within the contrib/create_unbound_ad_servers.sh script, when retrieving data before writing them into a configuration file. A remote non-authenticated attacker with ability to perform MitM attack can intercept and change Unbound configuration, as the input is retrieved via unencrypted HTTP channel.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Unbound: 1.0.0 - 1.9.4

---

External links
https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/
https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html
https://security.netapp.com/advisory/ntap-20210507-0007/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.