Nlnet Labs Unbound up to 1.16.1 Domain Name session expiration

Summaryinfo

A vulnerability was found in Nlnet Labs Unbound up to 1.16.1. It has been classified as problematic. Affected is an unknown function of the component Domain Name Handler. Performing a manipulation results in an unknown weakness. This vulnerability was named CVE-2022-30698. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Nlnet Labs Unbound up to 1.16.1. It has been classified as problematic. This affects an unknown code block of the component Domain Name Handler. CWE is classifying the issue as CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation. From version 1.16.2 on, Unbound checks the validity of parent delegation records before using cached delegation information.

The weakness was presented 08/01/2022. The advisory is shared at nlnetlabs.nl. This vulnerability is uniquely identified as CVE-2022-30698 since 05/13/2022. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 214466 (Debian dla-3371 : libunbound-dev - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.16.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (214466) and CERT Bund (WID-SEC-2022-2044). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Oracle Linux
• Red Hat OpenShift
• Gentoo Linux
• RESF Rocky Linux

Productinfo

Vendor

• Nlnet Labs

Name

• Unbound

Version

• 1.16.0
• 1.16.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion