Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.

The remote host is affected by the vulnerability described in GLSA-201311-18 (Unbound: Denial of Service)

    Multiple vulnerabilities have been discovered in Unbound. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition via       a specially crafted response.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the remote Unbound DNS resolver is affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists due to an     attempt to free unallocated memory during the processing     of duplicate CNAME records in a signed zone. An attacker     can exploit this, via a specially crafted response, to     cause a daemon crash, resulting in a denial of service     condition. (CVE-2011-4528)

  - A denial of service vulnerability exists due to improper     proof processing for NSEC3-signed zones. An attacker can     exploit this, via a malformed response that lacks     expected NSEC3 records, to cause a daemon crash,     resulting in a denial of service condition.
    (CVE-2011-4869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Unbound, a recursive DNS resolver, would crash when processing certain malformed DNS responses from authoritative DNS servers, leading to denial of service.

  - CVE-2011-4528     Unbound attempts to free unallocated memory during     processing of duplicate CNAME records in a signed zone.

  - CVE-2011-4869     Unbound does not properly process malformed responses     which lack expected NSEC3 records.

Security update for CVE-2011-4528 / VU#209659

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Unbound developer reports :

Unbound crashes when confronted with a non-standard response from a server for a domain. This domain produces duplicate RRs from a certain type and is DNSSEC signed. Unbound also crashes when confronted with a query that eventually, and under specific circumstances, resolves to a domain that misses expected NSEC3 records.

ID	Name	Product	Family	Severity
71120	GLSA-201311-18 : Unbound: Denial of Service	Nessus	Gentoo Local Security Checks	high
57574	Unbound < 1.4.14 / 1.4.13p2 Multiple DoS	Nessus	DNS	medium
57510	Debian DSA-2370-1 : unbound - several vulnerabilities	Nessus	Debian Local Security Checks	high
57422	Fedora 15 : unbound-1.4.14-1.fc15 (2011-17337)	Nessus	Fedora Local Security Checks	high
57421	Fedora 16 : unbound-1.4.14-1.fc16 (2011-17282)	Nessus	Fedora Local Security Checks	high
57338	FreeBSD : unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence (7ba65bfd-2a40-11e1-b96e-00215af774f0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-4528

high

Tenable Plugins

high

medium

high

high

high

medium