high7.5
CVE-2020-12662
Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue.
Impact
Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nlnetlabs | Unbound | before 1.10.1 |
| Debian | Debian Linux | Versions 9.0, 10.0 |
| Opensuse | Leap | Versions 15.1, 15.2 |
| Canonical | Ubuntu Linux | Versions 18.04, 19.10, 20.04 |
| Fedoraproject | Fedora | Versions 31, 32 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html
- http://www.nxnsattack.com
- http://www.openwall.com/lists/oss-security/2020/05/19/5
- https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ42N2HBZ3DXMSEC56SWIIOFQGOS5M7I/
- https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:19.unbound.asc
- https://security.netapp.com/advisory/ntap-20200702-0006/
- https://usn.ubuntu.com/4374-1/
- https://www.debian.org/security/2020/dsa-4694
- https://www.synology.com/security/advisory/Synology_SA_20_12
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html
- http://www.nxnsattack.com
- http://www.openwall.com/lists/oss-security/2020/05/19/5
- https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ42N2HBZ3DXMSEC56SWIIOFQGOS5M7I/
- https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:19.unbound.asc
- https://security.netapp.com/advisory/ntap-20200702-0006/
- https://usn.ubuntu.com/4374-1/
- https://www.debian.org/security/2020/dsa-4694