CentOS 8 : unbound (CESA-2020:1716)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1716 advisory. - unbound: command injection with data coming from a specially crafted IPSECKEY answer CVE-2019-18934 Note that Nessus has not tested for this issue but has...

unbound: command injection with data coming from a specially crafted IPSECKEY answer

A shell command injection vulnerability was discovered in the way unbound handles DNS queries for systems with a public key used for IPsec. When ipsecmod is enabled, a malicious DNS server could send a DNS reply which would be used during a following DNS query to execute shell commands with the...

Shell Code Execution

libunbound.so is vulnerable to shell code execution. The attack is possible due to not proper handling of a malicious IPSECKEY answer in the ipsec. The vulnerability can only triggered when the following conditions are met: 1 compiled the library with --enable-ipsecmod support, and ipsecmod is...