CVE-2009-3602
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.98%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.98% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- nlnetlabs/unbound
- Source
- secalert@redhat.com
References
- http://osvdb.org/58836
- http://secunia.com/advisories/36996Vendor Advisory
- http://secunia.com/advisories/37913
- http://unbound.net/pipermail/unbound-users/2009-October/000852.htmlVendor Advisory
- http://www.debian.org/security/2009/dsa-1963
- http://www.openwall.com/lists/oss-security/2009/10/09/2
- http://www.openwall.com/lists/oss-security/2009/10/09/3
- http://www.vupen.com/english/advisories/2009/2875Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53729
- http://osvdb.org/58836
- http://secunia.com/advisories/36996Vendor Advisory
- http://secunia.com/advisories/37913
- http://unbound.net/pipermail/unbound-users/2009-October/000852.htmlVendor Advisory
- http://www.debian.org/security/2009/dsa-1963
- http://www.openwall.com/lists/oss-security/2009/10/09/2
- http://www.openwall.com/lists/oss-security/2009/10/09/3
- http://www.vupen.com/english/advisories/2009/2875Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53729
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.