Summary
Ralph Dolmans and Karst Koymans discovered that Unbound did not properly
handle certain NSEC records. An attacker could use this to to prove the
non-existence (NXDOMAIN answer) of an existing wildcard record, or trick
Unbound into accepting a NODATA proof.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | unbound | 1.4.22-1ubuntu4.14.04.3 |
| Ubuntu · 16.04 LTS 16.04:LTS | unbound | 1.5.8-1ubuntu1.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | unbound | 1.6.7-1ubuntu2.1 |
Vulnerabilities 1
-
Unscored —
A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated w…
References
-
report
https://ubuntu.com/security/CVE-2017-15105