CVE-2024-33655: High severity Microsoft azl3 unbound 1.19.1-3 vulnerability
The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.
Other sources
The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases) aka the "DNSBomb" issue.
— Microsoft
The DNSBomb attack, via specially timed DNS queries and answers, can cause a Denial of Service on resolvers and spoofed targets.
Unbound itself is not vulnerable for DoS, rather it can be used to take part in a pulsing DoS amplification attack.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/unboundto a version that resolves this vulnerability.Fixed in 1.9.4-2ubuntu1.6 - Upgrade
Upgrade
ubuntu/unboundto a version that resolves this vulnerability.Fixed in 1.13.1-1ubuntu5.5 - Upgrade
Upgrade
ubuntu/unboundto a version that resolves this vulnerability.Fixed in 1.17.1-2ubuntu0.2 - Upgrade
Upgrade
ubuntu/unboundto a version that resolves this vulnerability.Fixed in 1.19.2-1ubuntu3.1 - Upgrade
Upgrade
ubuntu/unboundto a version that resolves this vulnerability.Fixed in 1.20.0-1 - Upgrade
Upgrade
alpine/unboundto a version that resolves this vulnerability.Fixed in 1.20.0-r0 - Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.17.1-2+deb12u3 - Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.20.0-1 - Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.17.1-2+deb12u4Fixed in 1.17.1-2+deb12u3Fixed in 1.22.0-2+deb13u3Fixed in 1.26.2-0+deb13u1Fixed in 1.26.2-1 - Upgrade
Upgrade
redhat/Unboundto a version that resolves this vulnerability.Fixed in 1.20.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-33655?
CVE-2024-33655 is classified as a denial of service vulnerability that can lead to resource consumption.
How do I fix CVE-2024-33655?
To fix CVE-2024-33655, update the unbound package to version 1.9.4-2ubuntu1.6 or higher for Ubuntu, or the corresponding version for Debian.
Which versions of unbound are affected by CVE-2024-33655?
Affected versions of unbound include versions earlier than 1.9.4-2ubuntu1.6 for Ubuntu and lower than 1.20.0-1 for Debian.
Can CVE-2024-33655 be exploited remotely?
Yes, CVE-2024-33655 can be exploited by remote attackers through manipulated DNS queries.
What are the potential impacts of CVE-2024-33655?
The primary impact of CVE-2024-33655 is service disruption due to resource exhaustion caused by a burst of DNS responses.