运行 CORE 5.04/MAIN 5.04 版本的远程 NewStart CGSL 主机上安装的 unbound 程序包受到多个漏洞的影响：

  - Unbound 1.10.1 之前版本中存在对网络消息容量的控制不充分，亦称 NXNSAttack 问题。此问题由 NS 记录中 NSDNAME 中的随机子域触发。(CVE-2020-12662)

  - Unbound 1.10.1 之前版本中存在通过从上游服务器接收的畸形 DNS 应答造成的无限循环。
    (CVE-2020-12663)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

安全修复：

  - unbound：针对 RHEL7 中 CVE-2020-12662 的不完整修复 (CVE-2020-10772)

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 2418 公告中提及的多个漏洞的影响。

  - unbound：将传入查询放大为指向目标的大量查询 (CVE-2020-12662)

  - unbound：通过从上游服务器接收的畸形 DNS 应答造成的无限循环 (CVE-2020-12663)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

来自 Red Hat 安全公告 2020:2416：

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 2416 公告中提及的多个漏洞的影响。

  - unbound：将传入查询放大为指向目标的大量查询 (CVE-2020-12662)

  - unbound：通过从上游服务器接收的畸形 DNS 应答造成的无限循环 (CVE-2020-12663)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

通过从上游服务器接收的畸形 DNS 应答造成的无限循环 (CVE-2020-12663)

网络消息量控制不足导致 DoS (CVE-2020-12662)

A network amplification vulnerability was found in Unbound, in the way it processes delegation messages from one authoritative zone to another. This flaw allows an attacker to cause a denial of service or be part of an attack against another DNS server when Unbound is deployed as a recursive resolver or authoritative name server.(CVE-2020-12662)

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers.(CVE-2020-12663)

Security fix for CVE-2020-12662 and CVE-2020-12663

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2414 advisory.

  - unbound: amplification of an incoming query into a large     number of queries directed to a target (CVE-2020-12662)

  - unbound: infinite loop via malformed DNS answers     received from upstream servers (CVE-2020-12663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - unbound: amplification of an incoming query into a large     number of queries directed to a target (CVE-2020-12662)

  - unbound: infinite loop via malformed DNS answers     received from upstream servers (CVE-2020-12663)

An update of the unbound package has been released.

NLNetLabs reports :

This release fixes CVE-2020-12662 and CVE-2020-12663.

Bug Fixes :

- CVE-2020-12662 Unbound can be tricked into amplifying an incoming query into a large number of queries directed to a target.

- CVE-2020-12663 Malformed answers from upstream name servers can be used to make Unbound unresponsive.

Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Unbound incorrectly handled certain queries. A remote attacker could use this issue to perform an amplification attack directed at a target. (CVE-2020-12662)

It was discovered that Unbound incorrectly handled certain malformed answers. A remote attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service. (CVE-2020-12663).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Unbound before 1.10.1 has Insufficient Control of     Network Message Volume, aka an 'NXNSAttack' issue. This     is triggered by random subdomains in the NSDNAME in NS     records.(CVE-2020-12662)

  - Unbound before 1.10.1 has an infinite loop via     malformed DNS answers received from upstream     servers.(CVE-2020-12663)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unbound package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in unbound in versions prior to     1.10.1. An infinite loop can be created when malformed     DNS answers are received from upstream servers. The     highest threat from this vulnerability is to system     availability.(CVE-2020-12663)

  - A network amplification vulnerability was found in     Unbound, in the way it processes delegation messages     from one authoritative zone to another. This flaw     allows an attacker to cause a denial of service or be     part of an attack against another DNS server when     Unbound is deployed as a recursive resolver or     authoritative name server.(CVE-2020-12662)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Unbound before 1.10.1 has an infinite loop via     malformed DNS answers received from upstream     servers.(CVE-2020-12663)

  - Unbound before 1.10.1 has Insufficient Control of     Network Message Volume, aka an 'NXNSAttack' issue. This     is triggered by random subdomains in the NSDNAME in NS     records.(CVE-2020-12662)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities have been corrected in unbound, a validating, recursive, caching DNS resolver. Support for the unbound DNS server has been resumed, the sources can be found in the unbound1.9 source package.

CVE-2020-12662

Unbound has Insufficient Control of Network Message Volume, aka an 'NXNSAttack' issue. This is triggered by random subdomains in the NSDNAME in NS records.

CVE-2020-12663

Unbound has an infinite loop via malformed DNS answers received from upstream servers.

CVE-2020-28935

Unbound contains a local vulnerability that would allow for a local symlink attack. When writing the PID file Unbound creates the file if it is not there, or opens an existing file for writing. In case the file was already present, it would follow symlinks if the file happened to be a symlink instead of a regular file. 

For Debian 9 stretch, these problems have been fixed in version 1.9.0-2+deb10u2~deb9u1.

We recommend that you upgrade your unbound1.9 packages.

For the detailed security status of unbound1.9 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/unbound1.9

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
143965	NewStart CGSL CORE 5.04 / MAIN 5.04：unbound 多个漏洞 (NS-SA-2020-0079)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2020/12/10	high
137743	Scientific Linux 安全更新：SL7.x x86_64 中的 unbound (20200622)	Nessus	Scientific Linux Local Security Checks	2020/6/23	2024/3/6	high
137236	RHEL 8：unbound (RHSA-2020: 2418)	Nessus	Red Hat Local Security Checks	2020/6/8	2024/4/28	high
137289	Oracle Linux 8：unbound (ELSA-2020-2416)	Nessus	Oracle Linux Local Security Checks	2020/6/10	2024/3/7	high
136753	Amazon Linux 2：unbound (ALAS-2020-1430)	Nessus	Amazon Linux Local Security Checks	2020/5/21	2024/3/12	high
137096	Amazon Linux AMI : unbound (ALAS-2020-1373)	Nessus	Amazon Linux Local Security Checks	2020/6/4	2024/3/8	high
137111	Fedora 32 : unbound (2020-3cfd38fefd)	Nessus	Fedora Local Security Checks	2020/6/4	2024/3/8	high
137281	CentOS 7 : unbound (CESA-2020:2414)	Nessus	CentOS Local Security Checks	2020/6/10	2024/3/7	high
137294	Scientific Linux Security Update : unbound on SL7.x x86_64 (20200609)	Nessus	Scientific Linux Local Security Checks	2020/6/10	2024/3/7	high
137329	Photon OS 2.0: Unbound PHSA-2020-2.0-0246	Nessus	PhotonOS Local Security Checks	2020/6/11	2024/7/22	high
136852	FreeBSD : unbound -- mutliple vulnerabilities (a2cb7c31-9c79-11ea-a9c2-d05099c0ae8c)	Nessus	FreeBSD Local Security Checks	2020/5/26	2024/3/8	high
136937	Fedora 31 : unbound (2020-8e9b62948e)	Nessus	Fedora Local Security Checks	2020/5/28	2024/3/8	high
136943	Ubuntu 18.04 LTS / 20.04 LTS : Unbound vulnerabilities (USN-4374-1)	Nessus	Ubuntu Local Security Checks	2020/5/28	2023/10/20	high
139160	EulerOS 2.0 SP8 : unbound (EulerOS-SA-2020-1830)	Nessus	Huawei Local Security Checks	2020/7/30	2024/2/27	high
140341	EulerOS Virtualization for ARM 64 3.0.2.0 : unbound (EulerOS-SA-2020-1971)	Nessus	Huawei Local Security Checks	2020/9/8	2024/2/21	high
142538	EulerOS Virtualization 3.0.6.6 : unbound (EulerOS-SA-2020-2454)	Nessus	Huawei Local Security Checks	2020/11/6	2021/1/6	high
146527	Debian DLA-2556-1 : unbound1.9 security update	Nessus	Debian Local Security Checks	2021/2/16	2024/1/22	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high