NetSight
IP …
high8.0

CVE-2024-1488

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configu…

Impact

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

Affected products

VendorProductAffected versions
FedoraprojectUnbound
before 1.19.1-2.fc40
RedhatCodeready Linux Builder
Version 9.0
RedhatCodeready Linux Builder Eus
Versions 9.2, 9.4
RedhatCodeready Linux Builder Eus For Power Little Endian
Versions 9.0_ppc64le, 9.2_ppc64le
RedhatCodeready Linux Builder For Arm64
Versions 9.0_aarch64, 9.2_aarch64
RedhatCodeready Linux Builder For Arm64 Eus
Version 9.4_aarch64
RedhatCodeready Linux Builder For Ibm Z Systems
Versions 9.0_s390x, 9.2_s390x
RedhatCodeready Linux Builder For Ibm Z Systems Eus
Version 9.4_s390x
RedhatEnterprise Linux
Versions 8.0, 9.0
RedhatEnterprise Linux Eus
Versions 8.6, 8.8, 9.2, 9.4
RedhatEnterprise Linux For Arm 64
Versions 8.0_aarch64, 9.0_aarch64, 9.2_aarch64
RedhatEnterprise Linux For Arm 64 Eus
Versions 8.6_aarch64, 8.8_aarch64, 9.4_aarch64

Weakness classification

CWE-276

References