Description
daemon/worker.c in Unbound 1.x before 1.4.10, when debugging functionality and the interface-automatic option are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DNS request that triggers improper error handling.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | unbound | 1.4.10-1 | — |
| Debian 13 | unbound | 1.4.10-1 | — |
| Debian 12 | unbound | 1.4.10-1 | — |
References
- FEDORA-2011-7555 vendor-advisory
- 47986 vdb-entry
- 44865 third-party-advisory
- 72750 vdb-entry
- VU#531342 third-party-advisory
- unbound-dns-dos(67645) vdb-entry
- http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt