[<prev] [next>] [day] [month] [year] [list]
Message-ID: <99854608-a9c2-4a73-ba81-431536d423d5@oracle.com>
Date: Fri, 16 Aug 2024 11:12:38 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Unbound 1.21.0 released with multiple security fixes
https://lists.nlnetlabs.nl/pipermail/unbound-users/2024-August/008377.html
announces the release of version 1.21.0 of this DNS server, including:
> This release has a fix for the CAMP and CacheFlush issues. They have a
> low severity for Unbound, since it does not affect Unbound so much.
>
> The Compositional Amplification (CAMP) type of attacks can lead to DoS
> attacks against DNS servers. In Unbound legitimate client requests to
> the resolvers under typical workload are not directly affected by CAMP
> attacks. However we introduce a global quota for 128 outgoing packets
> per query (and it's subqueries) that is never reset to prevent the
> combination of CAMP with other amplification attacks in the future. We
> would like to thank Huayi Duan, Marco Bearzi, Jodok Vieli, and Cagin
> Tanir from NetSec group, ETH Zurich for discovering and notifying us
> about the issue.
This appears to refer to:
https://www.usenix.org/conference/usenixsecurity24/presentation/duan
> The CacheFlush type of attacks (NSCacheFlush, CNAMECacheFlush) try to
> evict cached data by utilizing rogue zones and a steady rogue stream to
> a resolver. Based on the zone, the stream, the configured cache size
> and the legitimate traffic, Unbound could experience a degradation of
> service if a useful entry is evicted and Unbound needs to resolve again.
> As a mitigation to the NSCacheFlush attack Unbound is setting a limit
> of 20 RRs in an NS RRset. We would like to thank Yehuda Afek, Anat
> Bremler-Barr, Shoham Danino and Yuval Shavitt (Tel-Aviv University and
> Reichman University) for discovering and notifying us about the issue.
This appears to refer to:
https://www.usenix.org/conference/usenixsecurity24/presentation/afek
> - Fix #1071: [FR] Clear both in-memory and cachedb module cache with
> `unbound-control flush*` commands.
This appears to have been assigned CVE-2024-43167:
https://www.cve.org/CVERecord?id=CVE-2024-43167
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
