CVE-2024-1488: Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation
First published: Wed Feb 14 2024(Updated: )
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/unbound 1.19.1 | <2. | 2. |
| IBM QRadar SIEM | <=7.5 - 7.5.0 UP8 IF01 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2024:1750
- https://access.redhat.com/errata/RHSA-2024:1751
- https://access.redhat.com/errata/RHSA-2024:1780
- https://access.redhat.com/errata/RHSA-2024:1801
- https://access.redhat.com/errata/RHSA-2024:1802
- https://access.redhat.com/errata/RHSA-2024:1804
- https://access.redhat.com/errata/RHSA-2024:2587
- https://access.redhat.com/errata/RHSA-2024:2696
- https://access.redhat.com/security/cve/CVE-2024-1488
- https://bugzilla.redhat.com/show_bug.cgi?id=2264183
- https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d
- https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2264184
- https://exchange.xforce.ibmcloud.com/vulnerabilities/283575
- https://www.ibm.com/support/pages/node/7150684 (Advisory)
- agent/weakness
- agent/title
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/description
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/references
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-1488
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/ibm-support
- source/IBM
- package-manager/redhat
- vendor/ibm
- canonical/ibm qradar siem
- version/ibm qradar siem/7.5 - 7.5.0 up8 if01