Xiang Li

A heap-based buffer overflow exists in the DNSSEC validator of the Unbound DNS resolver. The issue occurs during the preparation of a DNSKEY digest within the `ds create dnskey digest()` function located in `validator/val sigcrypt.c`. An attacker controlling a malicious DNS zone can trigger this by providing a DNSKEY record where the owner compression pointer refers to its own RDATA. This causes the validator to decompress the data into a buffer without a proper capacity check, leading to a memory boundary crossing. This can result in a denial of service or possible remote code execution (RCE) within the resolver process, requiring no target credentials or user interaction.

Algorithmic complexity attacks, researched as 'ReTrap', can lead to service degradation when malicious zones are used. These attacks include TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism is exploited via responses with numerous mismatched DNSKEY, RRSIG, and DS records; DelegationTrap, which causes computational overhead during the iterative validation of the chain-of-trust for deeply nested domains; NsecTrap, which forces the resolver to validate excessive invalid NSEC records; and AdditionalTrap, where the default DNSSEC validation of the ADDITIONAL section is used to waste resources.

A use-after-free issue occurs when the software is compiled for DNS-over-HTTPs (DoH) support using the `--with-libnghttp2` flag. During failure code paths, such as an RPZ drop query or jostle caused by heavy traffic, a dropped DoH stream can terminate the entire DoH session without properly accounting for other active streams in that same session. A malicious actor can trigger this condition with a single DoH connection and specific traffic, provided the prerequisites are met. While the impact is limited because reads are not user-controlled and typically result in early returns, a hardened allocator may detect the use-after-free and terminate the process, leading to a denial of service.

A use-after-free issue occurs when the software is compiled for DNS-over-QUIC (DoQ) support using the `--with-libngtcp2` flag. In this configuration, each DoQ stream utilizes an output buffer for DNS responses. The `ngtcp2` retransmission buffer maintains a shallow pointer to this output buffer. When a client sends a RESET STREAM, the output buffer is freed, but `ngtcp2` retains the retransmission entries. A subsequent Probe Timeout (PTO) triggers `ngtcp2` to re-encode the STREAM frame and copy data from the already freed buffer. An unprivileged remote actor can trigger this by querying Unbound over DoQ, withholding acknowledgments, and sending a RESET STREAM. This can result in an abnormal server exit.

Zones configured with `zonemd-check: yes` that are located below a trust anchor contain a flaw where tampered zone contents may be served or stored to disk before the ZONEMD integrity check is completed. This occurs due to the asynchronous resolution of DS/DNSKEY records required for the check. If the `zonefile:` option is used to write a zonefile to disk while the ZONEMD check fails, the tampered data is reloaded upon startup and remains available until the next verification concludes. Even if verification subsequently fails, the tampered data persists on disk for future reloads.

يمكن للمهاجم الذي يقوم بتزوير الردود على الطلبات التي يتم إرسالها بواسطة Recursor مع تمكين ECS أن ينجح في هجومه. يتضمن الإصدار المحدث إجراءات تخفيف للمخاطر ضد محاولات تزوير الاستعلامات التي تم تمكين ECS فيها، وتسلسل الطلبات التي تم تمكين ECS فيها، وفرض تحقق أكثر صرامة من صحة الردود المستلمة. يتم تفعيل إجراء التخفيف الأكثر صرامة عند تمكين الإعداد `outgoing.edns subnet harden`.

تم اكتشاف ثغرة أمنية تتعلق بتسميم ذاكرة التخزين المؤقتة تؤثر على عدة مزودين، تُعرف باسم «Rebirthday Attack»، في برامج تحليل عناوين IP التي تدعم EDNS Client Subnet (ECS). يكون Unbound عرضة للخطر عند تجميعه مع دعم ECS (أي «--enable-subnet») وتهيئته لإرسال معلومات ECS إلى خوادم الأسماء الأعلى (أي عند استخدام خيار واحد على الأقل من الخيارات «send-client-subnet» أو «client-subnet-zone» أو «client-subnet-always-forward»). وهذا يتيح للجهات الخبيثة إمكانية مطابقة معرّفات معاملات DNS وتخزين استجابات مزيفة في ذاكرة التخزين المؤقت.

An issue was discovered in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

An issue in the forwarding mode enables attackers to create a query loop using Technitium resolvers, launching amplification attacks and potentially causing denial-of-service (DoS).

An issue in the software enables attackers to launch amplification attacks, potentially causing denial-of-service (DoS) with an amplification factor three times higher than other software like BIND.

The issue enables attackers to conduct a DNS cache poisoning attack, allowing them to inject fake responses within 1 second.

The issue allows attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack, enabling them to manipulate DNS responses.

The issue is related to the DNS protocol, which allows remote attackers to cause a denial of service by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst. This can be considered traffic amplification in some cases, also known as the "DNSBomb" issue. The attack works by sending a slow stream of modified DNS requests to DNS servers, which relay the data, increasing the packet size and holding it to then release all at once in a burst of DNS traffic directly at the target. The research group claims to have tested their technique on 10 major DNS programs and 46 public DNS services and was able to launch DNSBomb at a rate of up to 8.7 Gbit/s, with DNS traffic increased up to 20,000 times its original size.

The issue is related to errors in the representation of information by the user interface in the Windows DNS service. This can allow a remote attacker to conduct spoofing attacks.

The issue is related to a denial of service vulnerability in the c-ares library, which is an asynchronous resolver library. It occurs when a target resolver sends a query, and an attacker forges a malformed UDP packet with a length of 0, causing the target resolver to interpret the 0 length as a graceful shutdown of the connection. This can lead to a denial of service.

The issue is related to a denial of service vulnerability in PowerDNS Recursor, where authoritative servers can be marked as unavailable. This can be exploited by a remote attacker to cause a denial of service.

The issue enables attackers to consume the resolver's resources, launching amplification attacks and potentially causing a denial of service. A single client query may lead to a hundred TCP connection attempts if a DNS server closes connections without providing a response.

The issue allows a self-CNAME denial-of-service attack. This occurs when a CNAME loop causes an answer to contain hundreds of records.

An issue was discovered that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names.

An issue was discovered that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names.