EulerOS Virtualization 2.11.1 : unbound (EulerOS-SA-2026-3478)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347235);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2024-8508",
    "CVE-2024-33655",
    "CVE-2024-43168",
    "CVE-2025-5994",
    "CVE-2025-11411",
    "CVE-2026-32792",
    "CVE-2026-33278",
    "CVE-2026-40622",
    "CVE-2026-41292",
    "CVE-2026-42534",
    "CVE-2026-42923",
    "CVE-2026-42959",
    "CVE-2026-42960",
    "CVE-2026-44390"
  );
  script_xref(name:"IAVA", value:"2024-A-0682");

  script_name(english:"EulerOS Virtualization 2.11.1 : unbound (EulerOS-SA-2026-3478)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host
is affected by the following vulnerabilities :

    DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original
    software developer, NLnet Labs) falls within the expected functionality and security controls of the
    application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs
    has no further information about the claim, and suggests that affected Red Hat customers refer to
    available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was
    found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption.
    This issue could allow an attacker with local access to provide specially crafted input, potentially
    causing the application to crash or allowing arbitrary code execution. This could result in a denial of
    service or unauthorized actions on the system.(CVE-2024-43168)

    NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with
    very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very
    large RRsets can cause Unbound to spend a considerable time applying name compression to downstream
    replies. This can lead to degraded performance and eventually denial of service in well orchestrated
    attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially
    crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will
    try to apply name compression which was an unbounded operation that could lock the CPU until the whole
    packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression
    calculations it is willing to do per packet. Packets that need more compression will result in semi-
    compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long.
    This change should not affect normal DNS traffic.(CVE-2024-8508)

    The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource
    consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later
    sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the 'DNSBomb'
    issue.(CVE-2024-33655)

    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching
    resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS
    support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream
    name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-
    always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to
    accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox
    attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous
    replies.(CVE-2025-5994)

    NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.
    Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick
    resolvers to update their delegation information for the zone. Usually these RRSets are used to update the
    resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous
    effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be
    done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to
    update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for
    the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their
    respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an
    additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and
    non-referral nodata replies, further mitigating the possible poison effect.(CVE-2025-11411)

    NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator
    that enables denial of service and possible remote code execution as a result of deep copying a data
    structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by
    controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend
    validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-
    copies response messages to preserve them across memory region teardown. A struct-assignment bug
    overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the
    resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary
    code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep
    copying the data structure.(CVE-2026-33278)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records
    for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be
    used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply
    (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor
    can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by
    address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or
    fragmentation attacks. Unbound would then accept the relative address records in the additional section
    and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the
    delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the
    additional section if they are not explicitly relevant only to authority NS records, mitigating the
    possible poison effect. This is a complement fix to CVE-2025-11411.(CVE-2026-42960)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could
    defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age
    of slow running queries and not allow the jostle logic to see them as aged and potential targets for
    replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain
    name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and
    degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit,
    the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to
    resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need
    resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the
    original one that started the resolution effort. Cache and local data response performance remains
    unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1
    contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow
    the jostle logic to work as intended.(CVE-2026-42534)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where
    the code path to consult the negative cache for DS records does not take into account the limit on NSEC3
    hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An
    adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably
    high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the
    allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in
    1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the
    hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise
    the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable
    code path with the existing limit for NSEC3 hash calculations.(CVE-2026-42923)

    NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when
    compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's
    DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the
    vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00'
    bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than
    necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory
    layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low,
    since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow
    does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with
    a fix to bound reading in the given buffer space.(CVE-2026-32792)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack
    related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS
    options can hold Unbound threads hostage while they are parsing and creating internal data structures for
    the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1
    contains a patch with a fix to limit acceptable incoming EDNS options (100).(CVE-2026-41292)

    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC
    validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply
    messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section
    rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease
    the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator
    later dereferences this uninitialized pointer, causing an immediate process crash. An adversary
    controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain
    with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue
    records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write
    offsets.(CVE-2026-42959)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very
    large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very
    large RRsets with records that don't share a suffix above the root can cause Unbound to spend a
    considerable time applying name compression to downstream replies. This can lead to degraded performance
    and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability
    by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before
    Unbound replies to the query it will try to apply name compression which was an unbounded operation that
    could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for
    this but it didn't account for the case where records would not share any suffix above the root. That
    causes Unbound to go in a different code path because of the compression tree lookup failure and
    eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch
    with a fix that increments the compression counter regardless of the compression tree lookup. This is a
    complement fix to CVE-2024-8508.(CVE-2026-44390)

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain
    names' family of attacks that could extend the ghost domain window by up to one cached TTL configured
    value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be
    able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached
    expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost
    domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-
    referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound
    implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension
    of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization unbound security
advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3478
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b7e7c21b");
  script_set_attribute(attribute:"solution", value:
"Update the affected unbound packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/U:Red");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-33278");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-42960");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/05/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-unbound");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:unbound");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:unbound-libs");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.11.1");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.11.1") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.11.1");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "python3-unbound-1.13.2-3.h18.eulerosv2r11",
  "unbound-1.13.2-3.h18.eulerosv2r11",
  "unbound-libs-1.13.2-3.h18.eulerosv2r11"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "unbound");
}