search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Unbound multiple denial-of-service vulnerabilities

Vulnerability Note VU#209659

Original Release Date: 2011-12-19 | Last Revised: 2011-12-19

Overview

A specially crafted DNS query containing signed duplicate resource records or a malformed NSEC3 signed resource record may cause Unbound to crash.

Description

NLnetLabs advisory states:

== Description 1: crash on signed duplicate Resource Records

There are authoritative servers that erroneously send duplicated redirection Resource Records. Unbound has had a workaround that deals with this problem since version 1.0.1 whereby it ignores the duplicate answers. At the time, likely, no DNSSEC signed versions of such zones existed and only recently such misbehaving authority servers also started serving signed duplicate RRs causing improper memory allocation in a portion of the workaround code.

Referencing this improper allocated data causes a crash which can look like 'uninitialised lock', segmentation faults or free() errors as it tries to free memory that was never allocated.

== Description 2: crash on missing NSEC3 Resource Records.

If an authority server sends a reply for an NSEC3-signed zone, and Unbound is configured to validate that zone, then a malformed response can trigger an assertion failure: when an authority server sends a response that contains RR types that trigger special processing and where part of the non-existence proof is missing then an assertion failure is triggered in unbound. This response case was observed in the wild on authority servers that host zones at different points in the hierarchy at the same time.

The code crashes at assertion failure validator/val_nsec3.c:1214: nsec3_do_prove_nodata: assertion ce.nc_rrset failed Or, if assertions are not compiled it, it crashes soon after as it attempts to access an expected NSEC3 RR.

Additional details can be found in the full NLnetLabs Unbound advisory.

Impact

A remote, unauthenticated attacker could cause the Unbound daemon to crash creating a denial-of-service condition.

Solution

Apply an Update
This vulnerability has been addressed in Unbound 1.4.14 and 1.4.13p2. The following patch may also be applied to resolve the issue:

For unbound version 1.4.0 - 1.4.13 the patch is:
http://www.unbound.net/downloads/patch_CVE-2011-4528_unbound_140-1413.diff

For unbound version 1.0.1 - 1.3.4 the patch is:
http://www.unbound.net/downloads/patch_CVE-2011-4528_unbound_101-134.diff

Vendor Information

209659
 
Affected   Unknown   Unaffected

NLnet Labs

Notified:  December 14, 2011 Updated:  December 19, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.unbound.net/downloads/CVE-2011-4528.txt


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

This vulnerability was found by Christopher Olah and reported by NLnetLabs.

This document was written by Michael Orlando.

Other Information

CVE IDs: CVE-2011-4528
Severity Metric: 0.99
Date Public: 2011-12-19
Date First Published: 2011-12-19
Date Last Updated: 2011-12-19 18:44 UTC
Document Revision: 15

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.