REDHAT-BUG-2480127: Medium severity Nlnet Labs Unbound vulnerability
NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.25.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Unbound versions 1.16.2 through 1.25.0 are affected when an adversary can query the vulnerable resolver and controls a ghost zone. Deployments using the non-default setting "harden-referral-path: yes" have additional exposure because Unbound implicitly performs the relevant NS query.
What does an attacker need to do to extend the ghost-domain window?
The attacker must control a ghost zone and be able to query the vulnerable Unbound instance. Normally, a single client NS query triggers the overwrite of an expired parent-side referral NS rrset with the child apex NS rrset; with "harden-referral-path: yes", no client NS query is required.
What is the available fix?
Unbound 1.25.1 includes a fix that prevents TTL extension for parent NS records regardless of their trust. The issue can extend the ghost-domain window by up to the configured cached TTL value, "cache-max-ttl", on affected versions.