Unbound up to 1.19.3 config_file.c cfg_mark_ports heap-based overflow

Summaryinfo

A vulnerability was found in Unbound up to 1.19.3. It has been declared as critical. Affected by this vulnerability is the function cfg_mark_ports of the file config_file.c. Such manipulation leads to heap-based overflow. This vulnerability is traded as CVE-2024-43168. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Unbound up to 1.19.3. Affected by this issue is the function cfg_mark_ports of the file config_file.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system.

The advisory is shared for download at bugzilla.redhat.com. This vulnerability is handled as CVE-2024-43168 since 08/07/2024. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 207902 (Debian dla-3903 : libunbound-dev - security update), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (207902). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Unbound

Version

• 1.19.0
• 1.19.1
• 1.19.2
• 1.19.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion