Summary
Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Unbound
incorrectly handled certain queries. A remote attacker could use this issue
to perform an amplification attack directed at a target. (CVE-2020-12662)
It was discovered that Unbound incorrectly handled certain malformed
answers. A remote attacker could possibly use this issue to cause Unbound
to crash, resulting in a denial of service. (CVE-2020-12663)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | unbound | 1.6.7-1ubuntu2.3 |
| Ubuntu · 20.04 LTS 20.04:LTS | unbound | 1.9.4-2ubuntu1.1 |
Vulnerabilities 2
-
Unscored —
Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered …
-
Unscored —
Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers.