Vulnerabilities > CVE-2020-12662 - Resource Exhaustion vulnerability in multiple products

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.

Vulnerable Configurations

Part	Description	Count
Application	Nlnetlabs Nlnetlabs Unbound - Nlnetlabs Unbound 0.0 Nlnetlabs Unbound 0.1 Nlnetlabs Unbound 0.2 Nlnetlabs Unbound 0.3 Nlnetlabs Unbound 0.4 Nlnetlabs Unbound 0.5 Nlnetlabs Unbound 0.6 Nlnetlabs Unbound 0.7 Nlnetlabs Unbound 0.7.1 Nlnetlabs Unbound 0.7.2 Nlnetlabs Unbound 0.8 Nlnetlabs Unbound 0.9 Nlnetlabs Unbound 0.10 Nlnetlabs Unbound 0.11 Nlnetlabs Unbound 1.0.0 Nlnetlabs Unbound 1.0.1 Nlnetlabs Unbound 1.0.2 Nlnetlabs Unbound 1.1.0 Nlnetlabs Unbound 1.1.1 Nlnetlabs Unbound 1.2.0 Nlnetlabs Unbound 1.2.1 Nlnetlabs Unbound 1.3.0 Nlnetlabs Unbound 1.3.1 Nlnetlabs Unbound 1.3.2 Nlnetlabs Unbound 1.3.3 Nlnetlabs Unbound 1.3.4 Nlnetlabs Unbound 1.4.0 Nlnetlabs Unbound 1.4.1 Nlnetlabs Unbound 1.4.2 Nlnetlabs Unbound 1.4.3 Nlnetlabs Unbound 1.4.4 Nlnetlabs Unbound 1.4.5 Nlnetlabs Unbound 1.4.6 Nlnetlabs Unbound 1.4.7 Nlnetlabs Unbound 1.4.8 Nlnetlabs Unbound 1.4.9 Nlnetlabs Unbound 1.4.10 Nlnetlabs Unbound 1.4.11 Nlnetlabs Unbound 1.4.13 Nlnetlabs Unbound 1.4.14 Nlnetlabs Unbound 1.4.15 Nlnetlabs Unbound 1.4.16 Nlnetlabs Unbound 1.4.17 Nlnetlabs Unbound 1.4.18 Nlnetlabs Unbound 1.4.19 Nlnetlabs Unbound 1.4.20 Nlnetlabs Unbound 1.4.21 Nlnetlabs Unbound 1.4.22 Nlnetlabs Unbound 1.5.0 Nlnetlabs Unbound 1.5.1 Nlnetlabs Unbound 1.5.2 Nlnetlabs Unbound 1.5.3 Nlnetlabs Unbound 1.5.4 Nlnetlabs Unbound 1.5.5 Nlnetlabs Unbound 1.5.6 Nlnetlabs Unbound 1.5.6Rc1 Nlnetlabs Unbound 1.5.7 Nlnetlabs Unbound 1.5.8 Nlnetlabs Unbound 1.5.9 Nlnetlabs Unbound 1.5.10 Nlnetlabs Unbound 1.6.0 Nlnetlabs Unbound 1.6.1 Nlnetlabs Unbound 1.6.2 Nlnetlabs Unbound 1.6.3 Nlnetlabs Unbound 1.6.4 Nlnetlabs Unbound 1.6.5 Nlnetlabs Unbound 1.6.6 Nlnetlabs Unbound 1.6.6-5 Nlnetlabs Unbound 1.6.7 Nlnetlabs Unbound 1.6.8 Nlnetlabs Unbound 1.7.0 Nlnetlabs Unbound 1.7.1 Nlnetlabs Unbound 1.7.2 Nlnetlabs Unbound 1.7.3 Nlnetlabs Unbound 1.8.0 Nlnetlabs Unbound 1.8.1 Nlnetlabs Unbound 1.8.2 Nlnetlabs Unbound 1.8.3 Nlnetlabs Unbound 1.9.0 Nlnetlabs Unbound 1.9.2 Nlnetlabs Unbound 1.9.3 Nlnetlabs Unbound 1.9.4 Nlnetlabs Unbound 1.9.5 Nlnetlabs Unbound 1.9.6 Nlnetlabs Unbound 1.10.0	147
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0	2
OS	Opensuse Opensuse Leap 15.1 Opensuse Leap 15.2	2
OS	Canonical Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 19.10 Canonical Ubuntu Linux 20.04	3
OS	Fedoraproject Fedoraproject Fedora 31 Fedoraproject Fedora 32	2

Common Weakness Enumeration (CWE)

CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')

Common Attack Pattern Enumeration and Classification (CAPEC)

XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
XML Entity Expansion
An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.
Inducing Account Lockout
An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.
Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))
XML Denial of Service (XDoS) can be applied to any technology that utilizes XML data. This is, of course, most distributed systems technology including Java, .Net, databases, and so on. XDoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious XML payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. The main weakness in XDoS is that the service provider generally must inspect, parse, and validate the XML messages to determine routing, workflow, security considerations, and so on. It is exactly these inspection, parsing, and validation routines that XDoS targets. There are three primary attack vectors that XDoS can navigate Target CPU through recursion: attacker creates a recursive payload and sends to service provider Target memory through jumbo payloads: service provider uses DOM to parse XML. DOM creates in memory representation of XML document, but when document is very large (for example, north of 1 Gb) service provider host may exhaust memory trying to build memory objects. XML Ping of death: attack service provider with numerous small files that clog the system. All of the above attacks exploit the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends.

Nessus

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2020-2414.NASL
description	The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2414 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-13
modified	2020-06-10
plugin id	137281
published	2020-06-10
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137281
title	CentOS 7 : unbound (CESA-2020:2414)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2020:2414 and # CentOS Errata and Security Advisory 2020:2414 respectively. # include("compat.inc"); if (description) { script_id(137281); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"RHSA", value:"2020:2414"); script_name(english:"CentOS 7 : unbound (CESA-2020:2414)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2414 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number." ); # https://lists.centos.org/pipermail/centos-announce/2020-June/035751.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?e4a8b715" ); script_set_attribute( attribute:"solution", value:"Update the affected unbound packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-12662"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:unbound-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:unbound-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:unbound-python"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/06/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/10"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) \|\| "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"unbound-1.6.6-4.el7_8")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"unbound-devel-1.6.6-4.el7_8")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"unbound-libs-1.6.6-4.el7_8")) flag++; if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"unbound-python-1.6.6-4.el7_8")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "unbound / unbound-devel / unbound-libs / unbound-python"); }

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20200609_UNBOUND_ON_SL7_X.NASL
description	Security Fix(es) : - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663)
last seen	2020-06-13
modified	2020-06-10
plugin id	137294
published	2020-06-10
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137294
title	Scientific Linux Security Update : unbound on SL7.x x86_64 (20200609)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text is (C) Scientific Linux. # include("compat.inc"); if (description) { script_id(137294); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_name(english:"Scientific Linux Security Update : unbound on SL7.x x86_64 (20200609)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Scientific Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Security Fix(es) : - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663)" ); # https://listserv.fnal.gov/scripts/wa.exe?A2=ind2006&L=SCIENTIFIC-LINUX-ERRATA&P=3715 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?c4e4fc1f" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:unbound-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:unbound-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:unbound-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:unbound-python"); script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/06/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/10"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Scientific Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux"); os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 7.x", "Scientific Linux " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu); if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu); flag = 0; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"unbound-1.6.6-4.el7_8")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"unbound-debuginfo-1.6.6-4.el7_8")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"unbound-devel-1.6.6-4.el7_8")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"unbound-libs-1.6.6-4.el7_8")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"unbound-python-1.6.6-4.el7_8")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "unbound / unbound-debuginfo / unbound-devel / unbound-libs / etc"); }

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2020-2416.NASL
description	From Red Hat Security Advisory 2020:2416 : The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2416 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-11
modified	2020-06-10
plugin id	137289
published	2020-06-10
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137289
title	Oracle Linux 8 : unbound (ELSA-2020-2416)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2020:2416 and # Oracle Linux Security Advisory ELSA-2020-2416 respectively. # include("compat.inc"); if (description) { script_id(137289); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/22"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"RHSA", value:"2020:2416"); script_name(english:"Oracle Linux 8 : unbound (ELSA-2020-2416)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Oracle Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "From Red Hat Security Advisory 2020:2416 : The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2416 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number." ); script_set_attribute( attribute:"see_also", value:"https://oss.oracle.com/pipermail/el-errata/2020-June/010017.html" ); script_set_attribute( attribute:"solution", value:"Update the affected unbound packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python3-unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:unbound-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:unbound-libs"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:8"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/06/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/10"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Oracle Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux"); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| !pregmatch(pattern: "Oracle (?:Linux Server\|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux"); os_ver = pregmatch(pattern: "Oracle (?:Linux Server\|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux"); os_ver = os_ver[1]; if (! preg(pattern:"^8([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 8", "Oracle Linux " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu); if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu); flag = 0; if (rpm_check(release:"EL8", cpu:"x86_64", reference:"python3-unbound-1.7.3-11.el8_2")) flag++; if (rpm_check(release:"EL8", cpu:"x86_64", reference:"unbound-1.7.3-11.el8_2")) flag++; if (rpm_check(release:"EL8", cpu:"x86_64", reference:"unbound-devel-1.7.3-11.el8_2")) flag++; if (rpm_check(release:"EL8", cpu:"x86_64", reference:"unbound-libs-1.7.3-11.el8_2")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python3-unbound / unbound / unbound-devel / unbound-libs"); }

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2020-2418.NASL
description	The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2418 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-12
modified	2020-06-08
plugin id	137236
published	2020-06-08
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137236
title	RHEL 8 : unbound (RHSA-2020:2418)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2020:2418. The text # itself is copyright (C) Red Hat, Inc. # include('compat.inc'); if (description) { script_id(137236); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/10"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"RHSA", value:"2020:2418"); script_name(english:"RHEL 8 : unbound (RHSA-2020:2418)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute(attribute:"synopsis", value: "The remote Red Hat host is missing one or more security updates."); script_set_attribute(attribute:"description", value: "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2418 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/406.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/400.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/20.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/835.html"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:2418"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-12662"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-12663"); script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1837597"); script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1837604"); script_set_attribute(attribute:"solution", value: "Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-12663"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_cwe_id(20, 400, 406, 835); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/06/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/08"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:rhel_e4s:8.0"); script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:rhel_e4s:8.0::appstream"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-libs"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Red Hat Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include('audit.inc'); include('global_settings.inc'); include('misc_func.inc'); include('rpm.inc'); if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item('Host/RedHat/release'); if (isnull(release) \|\| 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat'); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat'); os_ver = os_ver[1]; if (! preg(pattern:"^8([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver); if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item('Host/cpu'); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu); pkgs = [ {'reference':'python3-unbound-1.7.3-9.el8_0', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'python3-unbound-1.7.3-9.el8_0', 'cpu':'s390x', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'python3-unbound-1.7.3-9.el8_0', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-1.7.3-9.el8_0', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-1.7.3-9.el8_0', 'cpu':'s390x', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-1.7.3-9.el8_0', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-debugsource-1.7.3-9.el8_0', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-debugsource-1.7.3-9.el8_0', 'cpu':'i686', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-debugsource-1.7.3-9.el8_0', 'cpu':'s390x', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-debugsource-1.7.3-9.el8_0', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-devel-1.7.3-9.el8_0', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-devel-1.7.3-9.el8_0', 'cpu':'i686', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-devel-1.7.3-9.el8_0', 'cpu':'s390x', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-devel-1.7.3-9.el8_0', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-libs-1.7.3-9.el8_0', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-libs-1.7.3-9.el8_0', 'cpu':'i686', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-libs-1.7.3-9.el8_0', 'cpu':'s390x', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-libs-1.7.3-9.el8_0', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_0', 'rpm_spec_vers_cmp':TRUE} ]; flag = 0; foreach package_array ( pkgs ) { reference = NULL; release = NULL; sp = NULL; cpu = NULL; el_string = NULL; rpm_spec_vers_cmp = NULL; epoch = NULL; allowmaj = NULL; if (!empty_or_null(package_array['reference'])) reference = package_array['reference']; if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release']; if (!empty_or_null(package_array['sp'])) sp = package_array['sp']; if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu']; if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string']; if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp']; if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch']; if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj']; if (reference && release) { if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++; } } if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python3-unbound / unbound / unbound-debugsource / etc'); }

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-4694.NASL
description	Two vulnerabiliites have been discovered in Unbound, a recursive-only caching DNS server; a traffic amplification attack against third-party authoritative name servers (NXNSAttack) and insufficient sanitisation of replies from upstream servers could result in denial of service via an infinite loop. The version of Unbound in the oldstable distribution (stretch) is no longer supported. If these security issues affect your setup, you should upgrade to the stable distribution (buster).
last seen	2020-06-06
modified	2020-05-28
plugin id	136933
published	2020-05-28
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/136933
title	Debian DSA-4694-1 : unbound - security update
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-4694. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(136933); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/05"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"DSA", value:"4694"); script_name(english:"Debian DSA-4694-1 : unbound - security update"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Two vulnerabiliites have been discovered in Unbound, a recursive-only caching DNS server; a traffic amplification attack against third-party authoritative name servers (NXNSAttack) and insufficient sanitisation of replies from upstream servers could result in denial of service via an infinite loop. The version of Unbound in the oldstable distribution (stretch) is no longer supported. If these security issues affect your setup, you should upgrade to the stable distribution (buster)." ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/unbound" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/buster/unbound" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2020/dsa-4694" ); script_set_attribute( attribute:"solution", value: "Upgrade the unbound packages. For the stable distribution (buster), these problems have been fixed in version 1.9.0-2+deb10u2." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:unbound"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/05/26"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/28"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"10.0", prefix:"libunbound-dev", reference:"1.9.0-2+deb10u2")) flag++; if (deb_check(release:"10.0", prefix:"libunbound8", reference:"1.9.0-2+deb10u2")) flag++; if (deb_check(release:"10.0", prefix:"python-unbound", reference:"1.9.0-2+deb10u2")) flag++; if (deb_check(release:"10.0", prefix:"python3-unbound", reference:"1.9.0-2+deb10u2")) flag++; if (deb_check(release:"10.0", prefix:"unbound", reference:"1.9.0-2+deb10u2")) flag++; if (deb_check(release:"10.0", prefix:"unbound-anchor", reference:"1.9.0-2+deb10u2")) flag++; if (deb_check(release:"10.0", prefix:"unbound-host", reference:"1.9.0-2+deb10u2")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2020-2419.NASL
description	The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2419 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-12
modified	2020-06-08
plugin id	137239
published	2020-06-08
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137239
title	RHEL 8 : unbound (RHSA-2020:2419)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2020:2419. The text # itself is copyright (C) Red Hat, Inc. # include('compat.inc'); if (description) { script_id(137239); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/10"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"RHSA", value:"2020:2419"); script_name(english:"RHEL 8 : unbound (RHSA-2020:2419)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute(attribute:"synopsis", value: "The remote Red Hat host is missing one or more security updates."); script_set_attribute(attribute:"description", value: "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2419 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/406.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/400.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/20.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/835.html"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:2419"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-12662"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-12663"); script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1837597"); script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1837604"); script_set_attribute(attribute:"solution", value: "Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-12663"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_cwe_id(20, 400, 406, 835); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/06/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/08"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:rhel_eus:8.1"); script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:rhel_eus:8.1::appstream"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-libs"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Red Hat Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include('audit.inc'); include('global_settings.inc'); include('misc_func.inc'); include('rpm.inc'); if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item('Host/RedHat/release'); if (isnull(release) \|\| 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat'); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat'); os_ver = os_ver[1]; if (! preg(pattern:"^8\.1([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 8.1', 'Red Hat ' + os_ver); if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item('Host/cpu'); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu); pkgs = [ {'reference':'python3-unbound-1.7.3-9.el8_1', 'sp':'1', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'python3-unbound-1.7.3-9.el8_1', 'sp':'1', 'cpu':'s390x', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'python3-unbound-1.7.3-9.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-1.7.3-9.el8_1', 'sp':'1', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-1.7.3-9.el8_1', 'sp':'1', 'cpu':'s390x', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-1.7.3-9.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-debugsource-1.7.3-9.el8_1', 'sp':'1', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-debugsource-1.7.3-9.el8_1', 'sp':'1', 'cpu':'i686', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-debugsource-1.7.3-9.el8_1', 'sp':'1', 'cpu':'s390x', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-debugsource-1.7.3-9.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-devel-1.7.3-9.el8_1', 'sp':'1', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-devel-1.7.3-9.el8_1', 'sp':'1', 'cpu':'i686', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-devel-1.7.3-9.el8_1', 'sp':'1', 'cpu':'s390x', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-devel-1.7.3-9.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-libs-1.7.3-9.el8_1', 'sp':'1', 'cpu':'aarch64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-libs-1.7.3-9.el8_1', 'sp':'1', 'cpu':'i686', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-libs-1.7.3-9.el8_1', 'sp':'1', 'cpu':'s390x', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE}, {'reference':'unbound-libs-1.7.3-9.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'el_string':'el8_1', 'rpm_spec_vers_cmp':TRUE} ]; flag = 0; foreach package_array ( pkgs ) { reference = NULL; release = NULL; sp = NULL; cpu = NULL; el_string = NULL; rpm_spec_vers_cmp = NULL; epoch = NULL; allowmaj = NULL; if (!empty_or_null(package_array['reference'])) reference = package_array['reference']; if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release']; if (!empty_or_null(package_array['sp'])) sp = package_array['sp']; if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu']; if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string']; if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp']; if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch']; if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj']; if (reference && release) { if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++; } } if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python3-unbound / unbound / unbound-debugsource / etc'); }

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-4374-1.NASL
description	Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Unbound incorrectly handled certain queries. A remote attacker could use this issue to perform an amplification attack directed at a target. (CVE-2020-12662) It was discovered that Unbound incorrectly handled certain malformed answers. A remote attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service. (CVE-2020-12663). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-06
modified	2020-05-28
plugin id	136943
published	2020-05-28
reporter	Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/136943
title	Ubuntu 18.04 LTS / 19.10 / 20.04 : unbound vulnerabilities (USN-4374-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-4374-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(136943); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/05"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"USN", value:"4374-1"); script_name(english:"Ubuntu 18.04 LTS / 19.10 / 20.04 : unbound vulnerabilities (USN-4374-1)"); script_summary(english:"Checks dpkg output for updated packages."); script_set_attribute( attribute:"synopsis", value: "The remote Ubuntu host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Unbound incorrectly handled certain queries. A remote attacker could use this issue to perform an amplification attack directed at a target. (CVE-2020-12662) It was discovered that Unbound incorrectly handled certain malformed answers. A remote attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service. (CVE-2020-12663). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/4374-1/" ); script_set_attribute( attribute:"solution", value: "Update the affected libunbound2, libunbound8 and / or unbound packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libunbound2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libunbound8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:unbound"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.10"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/05/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/28"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(18\.04\|19\.10\|20\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 18.04 / 19.10 / 20.04", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"18.04", pkgname:"libunbound2", pkgver:"1.6.7-1ubuntu2.3")) flag++; if (ubuntu_check(osver:"18.04", pkgname:"unbound", pkgver:"1.6.7-1ubuntu2.3")) flag++; if (ubuntu_check(osver:"19.10", pkgname:"libunbound8", pkgver:"1.9.0-2ubuntu1.1")) flag++; if (ubuntu_check(osver:"19.10", pkgname:"unbound", pkgver:"1.9.0-2ubuntu1.1")) flag++; if (ubuntu_check(osver:"20.04", pkgname:"libunbound8", pkgver:"1.9.4-2ubuntu1.1")) flag++; if (ubuntu_check(osver:"20.04", pkgname:"unbound", pkgver:"1.9.4-2ubuntu1.1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libunbound2 / libunbound8 / unbound"); }

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2020-2416.NASL
description	The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2416 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-12
modified	2020-06-08
plugin id	137238
published	2020-06-08
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137238
title	RHEL 8 : unbound (RHSA-2020:2416)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2020:2416. The text # itself is copyright (C) Red Hat, Inc. # include('compat.inc'); if (description) { script_id(137238); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/10"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"RHSA", value:"2020:2416"); script_name(english:"RHEL 8 : unbound (RHSA-2020:2416)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute(attribute:"synopsis", value: "The remote Red Hat host is missing one or more security updates."); script_set_attribute(attribute:"description", value: "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2416 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/406.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/400.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/20.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/835.html"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:2416"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-12662"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-12663"); script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1837597"); script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1837604"); script_set_attribute(attribute:"solution", value: "Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-12663"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_cwe_id(20, 400, 406, 835); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/06/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/08"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:8::appstream"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-libs"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Red Hat Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include('audit.inc'); include('global_settings.inc'); include('misc_func.inc'); include('rpm.inc'); if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item('Host/RedHat/release'); if (isnull(release) \|\| 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat'); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat'); os_ver = os_ver[1]; if (! preg(pattern:"^8([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver); if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item('Host/cpu'); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu); pkgs = [ {'reference':'python3-unbound-1.7.3-11.el8_2', 'cpu':'aarch64', 'release':'8'}, {'reference':'python3-unbound-1.7.3-11.el8_2', 'cpu':'s390x', 'release':'8'}, {'reference':'python3-unbound-1.7.3-11.el8_2', 'cpu':'x86_64', 'release':'8'}, {'reference':'unbound-1.7.3-11.el8_2', 'cpu':'aarch64', 'release':'8'}, {'reference':'unbound-1.7.3-11.el8_2', 'cpu':'s390x', 'release':'8'}, {'reference':'unbound-1.7.3-11.el8_2', 'cpu':'x86_64', 'release':'8'}, {'reference':'unbound-debugsource-1.7.3-11.el8_2', 'cpu':'aarch64', 'release':'8'}, {'reference':'unbound-debugsource-1.7.3-11.el8_2', 'cpu':'i686', 'release':'8'}, {'reference':'unbound-debugsource-1.7.3-11.el8_2', 'cpu':'s390x', 'release':'8'}, {'reference':'unbound-debugsource-1.7.3-11.el8_2', 'cpu':'x86_64', 'release':'8'}, {'reference':'unbound-devel-1.7.3-11.el8_2', 'cpu':'aarch64', 'release':'8'}, {'reference':'unbound-devel-1.7.3-11.el8_2', 'cpu':'i686', 'release':'8'}, {'reference':'unbound-devel-1.7.3-11.el8_2', 'cpu':'s390x', 'release':'8'}, {'reference':'unbound-devel-1.7.3-11.el8_2', 'cpu':'x86_64', 'release':'8'}, {'reference':'unbound-libs-1.7.3-11.el8_2', 'cpu':'aarch64', 'release':'8'}, {'reference':'unbound-libs-1.7.3-11.el8_2', 'cpu':'i686', 'release':'8'}, {'reference':'unbound-libs-1.7.3-11.el8_2', 'cpu':'s390x', 'release':'8'}, {'reference':'unbound-libs-1.7.3-11.el8_2', 'cpu':'x86_64', 'release':'8'} ]; flag = 0; foreach package_array ( pkgs ) { reference = NULL; release = NULL; sp = NULL; cpu = NULL; el_string = NULL; rpm_spec_vers_cmp = NULL; epoch = NULL; allowmaj = NULL; if (!empty_or_null(package_array['reference'])) reference = package_array['reference']; if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release']; if (!empty_or_null(package_array['sp'])) sp = package_array['sp']; if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu']; if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string']; if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp']; if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch']; if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj']; if (reference && release) { if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++; } } if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python3-unbound / unbound / unbound-debugsource / etc'); }

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2020-2414.NASL
description	The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2414 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-12
modified	2020-06-08
plugin id	137204
published	2020-06-08
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137204
title	RHEL 7 : unbound (RHSA-2020:2414)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2020:2414. The text # itself is copyright (C) Red Hat, Inc. # include('compat.inc'); if (description) { script_id(137204); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/10"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"RHSA", value:"2020:2414"); script_name(english:"RHEL 7 : unbound (RHSA-2020:2414)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute(attribute:"synopsis", value: "The remote Red Hat host is missing one or more security updates."); script_set_attribute(attribute:"description", value: "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2414 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/406.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/400.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/20.html"); script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/835.html"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:2414"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-12662"); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-12663"); script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1837597"); script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1837604"); script_set_attribute(attribute:"solution", value: "Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-12663"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_cwe_id(20, 400, 406, 835); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/06/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/08"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::client"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::computenode"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::workstation"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:unbound-python"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Red Hat Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include('audit.inc'); include('global_settings.inc'); include('misc_func.inc'); include('rpm.inc'); if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item('Host/RedHat/release'); if (isnull(release) \|\| 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat'); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat'); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver); if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item('Host/cpu'); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu); pkgs = [ {'reference':'unbound-1.6.6-4.el7_8', 'cpu':'s390x', 'release':'7'}, {'reference':'unbound-1.6.6-4.el7_8', 'cpu':'x86_64', 'release':'7'}, {'reference':'unbound-devel-1.6.6-4.el7_8', 'cpu':'i686', 'release':'7'}, {'reference':'unbound-devel-1.6.6-4.el7_8', 'cpu':'s390', 'release':'7'}, {'reference':'unbound-devel-1.6.6-4.el7_8', 'cpu':'s390x', 'release':'7'}, {'reference':'unbound-devel-1.6.6-4.el7_8', 'cpu':'x86_64', 'release':'7'}, {'reference':'unbound-libs-1.6.6-4.el7_8', 'cpu':'i686', 'release':'7'}, {'reference':'unbound-libs-1.6.6-4.el7_8', 'cpu':'s390', 'release':'7'}, {'reference':'unbound-libs-1.6.6-4.el7_8', 'cpu':'s390x', 'release':'7'}, {'reference':'unbound-libs-1.6.6-4.el7_8', 'cpu':'x86_64', 'release':'7'}, {'reference':'unbound-python-1.6.6-4.el7_8', 'cpu':'s390x', 'release':'7'}, {'reference':'unbound-python-1.6.6-4.el7_8', 'cpu':'x86_64', 'release':'7'} ]; flag = 0; foreach package_array ( pkgs ) { reference = NULL; release = NULL; sp = NULL; cpu = NULL; el_string = NULL; rpm_spec_vers_cmp = NULL; epoch = NULL; allowmaj = NULL; if (!empty_or_null(package_array['reference'])) reference = package_array['reference']; if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release']; if (!empty_or_null(package_array['sp'])) sp = package_array['sp']; if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu']; if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string']; if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp']; if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch']; if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj']; if (reference && release) { if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++; } } if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'unbound / unbound-devel / unbound-libs / etc'); }

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2020-1373.NASL
description	A network amplification vulnerability was found in Unbound, in the way it processes delegation messages from one authoritative zone to another. This flaw allows an attacker to cause a denial of service or be part of an attack against another DNS server when Unbound is deployed as a recursive resolver or authoritative name server.(CVE-2020-12662) Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers.(CVE-2020-12663)
last seen	2020-06-10
modified	2020-06-04
plugin id	137096
published	2020-06-04
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137096
title	Amazon Linux AMI : unbound (ALAS-2020-1373)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Amazon Linux AMI Security Advisory ALAS-2020-1373. # include("compat.inc"); if (description) { script_id(137096); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/09"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"ALAS", value:"2020-1373"); script_name(english:"Amazon Linux AMI : unbound (ALAS-2020-1373)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Amazon Linux AMI host is missing a security update." ); script_set_attribute( attribute:"description", value: "A network amplification vulnerability was found in Unbound, in the way it processes delegation messages from one authoritative zone to another. This flaw allows an attacker to cause a denial of service or be part of an attack against another DNS server when Unbound is deployed as a recursive resolver or authoritative name server.(CVE-2020-12662) Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers.(CVE-2020-12663)" ); script_set_attribute( attribute:"see_also", value:"https://alas.aws.amazon.com/ALAS-2020-1373.html" ); script_set_attribute( attribute:"solution", value:"Run 'yum update unbound' to update your system." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-python"); script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/06/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/04"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Amazon Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/AmazonLinux/release"); if (isnull(release) \|\| !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux"); os_ver = pregmatch(pattern: "^AL(A\|\d)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux"); os_ver = os_ver[1]; if (os_ver != "A") { if (os_ver == 'A') os_ver = 'AMI'; audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver); } if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (rpm_check(release:"ALA", reference:"unbound-1.6.6-1.5.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"unbound-debuginfo-1.6.6-1.5.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"unbound-devel-1.6.6-1.5.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"unbound-libs-1.6.6-1.5.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"unbound-python-1.6.6-1.5.amzn1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "unbound / unbound-debuginfo / unbound-devel / unbound-libs / etc"); }

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2020-3CFD38FEFD.NASL
description	Security fix for CVE-2020-12662 and CVE-2020-12663 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-10
modified	2020-06-04
plugin id	137111
published	2020-06-04
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137111
title	Fedora 32 : unbound (2020-3cfd38fefd)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory FEDORA-2020-3cfd38fefd. # include("compat.inc"); if (description) { script_id(137111); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/09"); script_cve_id("CVE-2020-12662", "CVE-2020-12663"); script_xref(name:"FEDORA", value:"2020-3cfd38fefd"); script_name(english:"Fedora 32 : unbound (2020-3cfd38fefd)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "Security fix for CVE-2020-12662 and CVE-2020-12663 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2020-3cfd38fefd" ); script_set_attribute( attribute:"solution", value:"Update the affected unbound package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:unbound"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:32"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/19"); script_set_attribute(attribute:"patch_publication_date", value:"2020/05/24"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/04"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! preg(pattern:"^32([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 32", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC32", reference:"unbound-1.10.1-1.fc32")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "unbound"); }

NASL family	Amazon Linux Local Security Checks
NASL id	AL2_ALAS-2020-1430.NASL
description	infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) insufficient control of network message volume leads to DoS (CVE-2020-12662)
last seen	2020-05-31
modified	2020-05-21
plugin id	136753
published	2020-05-21
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/136753
title	Amazon Linux 2 : unbound (ALAS-2020-1430)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2020-8E9B62948E.NASL
description	Security fix for CVE-2020-12662 and CVE-2020-12663 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-06
modified	2020-05-28
plugin id	136937
published	2020-05-28
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/136937
title	Fedora 31 : unbound (2020-8e9b62948e)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2020-2414.NASL
description	From Red Hat Security Advisory 2020:2414 : The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2414 advisory. - unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-12
modified	2020-06-09
plugin id	137250
published	2020-06-09
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137250
title	Oracle Linux 7 : unbound (ELSA-2020-2414)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2020-2_0-0246_UNBOUND.NASL
description	An update of the unbound package has been released.
last seen	2020-06-12
modified	2020-06-11
plugin id	137329
published	2020-06-11
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137329
title	Photon OS 2.0: Unbound PHSA-2020-2.0-0246

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_A2CB7C319C7911EAA9C2D05099C0AE8C.NASL
description	NLNetLabs reports : This release fixes CVE-2020-12662 and CVE-2020-12663. Bug Fixes : - CVE-2020-12662 Unbound can be tricked into amplifying an incoming query into a large number of queries directed to a target. - CVE-2020-12663 Malformed answers from upstream name servers can be used to make Unbound unresponsive.
last seen	2020-05-31
modified	2020-05-26
plugin id	136852
published	2020-05-26
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/136852
title	FreeBSD : unbound -- mutliple vulnerabilities (a2cb7c31-9c79-11ea-a9c2-d05099c0ae8c)

Redhat

rpms

unbound-0:1.6.6-4.el7_8
unbound-debuginfo-0:1.6.6-4.el7_8
unbound-devel-0:1.6.6-4.el7_8
unbound-libs-0:1.6.6-4.el7_8
unbound-python-0:1.6.6-4.el7_8
python3-unbound-0:1.7.3-11.el8_2
python3-unbound-debuginfo-0:1.7.3-11.el8_2
unbound-0:1.7.3-11.el8_2
unbound-debuginfo-0:1.7.3-11.el8_2
unbound-debugsource-0:1.7.3-11.el8_2
unbound-devel-0:1.7.3-11.el8_2
unbound-libs-0:1.7.3-11.el8_2
unbound-libs-debuginfo-0:1.7.3-11.el8_2
python3-unbound-0:1.7.3-9.el8_0
python3-unbound-debuginfo-0:1.7.3-9.el8_0
unbound-0:1.7.3-9.el8_0
unbound-debuginfo-0:1.7.3-9.el8_0
unbound-debugsource-0:1.7.3-9.el8_0
unbound-devel-0:1.7.3-9.el8_0
unbound-libs-0:1.7.3-9.el8_0
unbound-libs-debuginfo-0:1.7.3-9.el8_0
python3-unbound-0:1.7.3-9.el8_1
python3-unbound-debuginfo-0:1.7.3-9.el8_1
unbound-0:1.7.3-9.el8_1
unbound-debuginfo-0:1.7.3-9.el8_1
unbound-debugsource-0:1.7.3-9.el8_1
unbound-devel-0:1.7.3-9.el8_1
unbound-libs-0:1.7.3-9.el8_1
unbound-libs-debuginfo-0:1.7.3-9.el8_1

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Redhat

References