dns-nsec3-enum NSE Script

Tries to enumerate domain names from the DNS server that supports DNSSEC NSEC3 records. The script queries for nonexistant domains until it exhausts all domain ranges keeping track of hashes. At the end, all hashes are printed along with salt and number of iterations used. This technique is known...

Unbound < 1.4.14 / 1.4.13p2 Multiple DoS

According to its self-reported version number, the remote Unbound DNS resolver is affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists due to an attempt to free unallocated memory during the processing of duplicate CNAME records in a signed zone. An...

DSA-2370-1 unbound - several

Bulletin has no description...

CVE-2011-4869

validator/valnsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service daemon crash via a malformed response that lacks expected NSEC3 records, a different vulnerability than CVE-2011-4528...

CVE-2011-4869

validator/valnsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service daemon crash via a malformed response that lacks expected NSEC3 records, a different vulnerability than CVE-2011-4528...

Design/Logic Flaw

validator/valnsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service daemon crash via a malformed response that lacks expected NSEC3 records, a different vulnerability than CVE-2011-4528...

CVE-2011-4869

validator/valnsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service daemon crash via a malformed response that lacks expected NSEC3 records, a different vulnerability than CVE-2011-4528...

CVE-2011-4869

CVE-2011-4528 and CVE-2011-4869 in Unbound describe remote-denial-of-service via crafted responses or memory handling issues in the 1.4.x series. CVE-2011-4528: during processing of duplicate CNAMEs in a signed zone, Unbound may free unallocated memory, potentially crashing the daemon. CVE-2011-4...

unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence

Unbound developer reports: Unbound crashes when confronted with a non-standard response from a server for a domain. This domain produces duplicate RRs from a certain type and is DNSSEC signed. Unbound also crashes when confronted with a query that eventually, and under specific circumstances,...

Unbound multiple denial-of-service vulnerabilities

Overview A specially crafted DNS query containing signed duplicate resource records or a malformed NSEC3 signed resource record may cause Unbound to crash. Description NLnetLabs advisory states:== Description 1: crash on signed duplicate Resource Records There are authoritative servers that...

OpenDNSSEC 1.3.0rc2 new Version released !

OpenDNSSEC 1.3.0rc2 new Version released ! Version 1.3.0rc2 of OpenDNSSEC Match the names of the signer pidfile and enforcer pidfile. Include check for resign resalt in ods-kaspcheck. Bugfixes: Bugfix 231: Fix MySQL version check. ods-ksmutil: Update now sends a HUP to the enforcerd. Signer Engin...

dns-nsec-enum NSE Script

Enumerates DNS names using the DNSSEC NSEC-walking technique. Output is arranged by domain. Within a domain, subzones are shown with increased indentation. The NSEC response record in DNSSEC is used to give negative answers to queries, but it has the side effect of allowing enumeration of all...

Debian DSA-2054-1 : bind9 - DNS cache poisoning

Several cache-poisoning vulnerabilities have been discovered in BIND. These vulnerabilities apply only if DNSSEC validation is enabled and trust anchors have been installed, which is not the default. The Common Vulnerabilities and Exposures project identifies the following problems : -...

Debian DSA-1963-1 : unbound - cryptographic implementation error

It was discovered that Unbound, a DNS resolver, does not properly check cryptographic signatures on NSEC3 records. As a result, zones signed with the NSEC3 variant of DNSSEC lose their cryptographic protection. An attacker would still have to carry out an ordinary cache poisoning attack to add ba...

openSUSE Security Update : unbound (unbound-2015)

Unbound did not check signatures on NSEC3 records which allowed attackers who could spoof DNS responses to bypass DNSSEC. CVE-2009-3602: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

openSUSE Security Update : unbound (unbound-2015)

Unbound did not check signatures on NSEC3 records which allowed attackers who could spoof DNS responses to bypass DNSSEC. CVE-2009-3602: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

DEBIAN-CVE-2010-0097

ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC 1 NSEC and 2 NSEC3 records, which allows remote attackers to add the Authenticated Data AD flag to a forged NXDOMAIN response for an existing domain...

Code injection

ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC 1 NSEC and 2 NSEC3 records, which allows remote attackers to add the Authenticated Data AD flag to a forged NXDOMAIN response for an existing domain...

CVE-2010-0097

CVE-2010-0097 affects ISC BIND 9.x where DNSSEC validation of NSEC/NSEC3 records is flawed, enabling remote attackers to add the AD flag to forged NXDOMAIN responses for an existing domain. Public advisories confirm fixes in later BIND releases (upstream: 9.6-ESV-R1 and 9.7.0.dfsg) and point to u...

ISC BIND 9 DNSSEC NSEC/NSEC3 Bogus NXDOMAIN Responses

According to its version number, the remote installation of BIND suffers from a cache poisoning vulnerability. The vulnerability exists due to an error in DNSSEC NSEC/NSEC3 validation code which could cause caching of bogus NXDOMAIN responses without correctly validating them. This issue affects...