7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.017 Low
EPSS
Percentile
87.7%
Severity: High
Date : 2020-05-20
CVE-ID : CVE-2020-12662 CVE-2020-12663
Package : unbound
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-1164
The package unbound before version 1.10.1-1 is vulnerable to denial of
service.
Upgrade to 1.10.1-1.
The problems have been fixed upstream in version 1.10.1.
None.
An issue has been found in unbound before 1.10.1, that makes it
possible to have a single incoming query result in a large number of
outgoing queries. This amplification makes it possible for Unbound to
be used in a denial of service attack. The researchers discovering this
called this attack the NXNSattack.This attack makes use of cache
bypassing using random subdomains in the NSDNAME in NS records. When
these delegation records are received during iteration, and the answer
does not contain glue records, a resolver has to send out a query to
the get the IP address for one of the names. When this query fails (for
example because the random name does not exist) a resolver will try the
next one. A large set of NS records with random names can result in a
large number of outgoing queries going to the same target.
A security issue has been found in Unbound before 1.1.0.1, in the
parser of received answers. Malformed answers received from upstream
servers can result in Unbound entering an infinite loop and thereby
becoming unresponsive.
A remote attacker can use the recursor has an amplification vector to
cause a denial of service via a crafted reply. In addition, a remote
attacker can crash the application via a crafted request.
https://nlnetlabs.nl/projects/unbound/security-advisories/
https://nlnetlabs.nl/downloads/unbound/patch_cve_2020-12662_2020-12663.diff
http://www.nxnsattack.com/
https://security.archlinux.org/CVE-2020-12662
https://security.archlinux.org/CVE-2020-12663
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.017 Low
EPSS
Percentile
87.7%