Summary
USN-7855-1 fixed vulnerabilities in Unbound. It was discovered that the fix
for CVE-2025-11411 was incomplete. This update fixes the problem.
Original advisory details:
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that
Unbound incorrectly handled certain promiscuous NS RRSets. A remote
attacker could possibly use this issue to perform a domain hijack attack.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | unbound | 1.13.1-1ubuntu5.14 |
| Ubuntu · 24.04 LTS 24.04:LTS | unbound | 1.19.2-1ubuntu3.7 |
| Ubuntu · 25.10 | unbound | 1.22.0-2ubuntu2.2 |
Vulnerabilities 1
-
Medium 5.7
Possible domain hijacking via promiscuous records in the authority section
NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information fo…