Ubuntu.comUB:CVE-2024-1488CVE-2024-1488
8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
7.7 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
13.2%
A vulnerability was found in Unbound due to incorrect default permissions,
allowing any process outside the unbound group to modify the unbound
runtime configuration. If a process can connect over localhost to port
8953, it can alter the configuration of unbound.service. This flaw allows
an unprivileged attacker to manipulate a running instance, potentially
altering forwarders, allowing them to track all queries forwarded by the
local resolver, and, in some cases, disrupting resolving altogether.
Notes
| Author | Note |
|---|---|
| mdeslaur | This is an issue specific to Red Hat packaging, Ubuntu is not affected by this issue. |
Related
8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
7.7 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
13.2%