Executive Summary
| Summary | |
|---|---|
| Title | New unbound packages fix DNSSEC validation |
| Informations | |||
|---|---|---|---|
| Name | DSA-1963 | First vendor Publication | 2009-12-23 |
| Vendor | Debian | Last vendor Modification | 2009-12-23 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| It was discovered that Unbound, a DNS resolver, does not properly check cryptographic signatures on NSEC3 records. As a result, zones signed with the NSEC3 variant of DNSSEC lose their cryptographic protection. (An attacker would still have to carry out an ordinary cache poisoning attack to add bad data to the cache.) The old stable distribution (etch) does not contain an unbound package. For the stable distribution (lenny), this problem has been fixed in version 1.0.2-1+lenny1. For the unstable distribution (sid) and the testing distribution (squeeze), this problem has been fixed in version 1.3.4-1. We recommend that you upgrade your unbound package. |
Original Source
| Url : http://www.debian.org/security/2009/dsa-1963 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-310 | Cryptographic Issues |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13307 | |||
| Oval ID: | oval:org.mitre.oval:def:13307 | ||
| Title: | DSA-1963-1 unbound -- cryptographic implementation error | ||
| Description: | It was discovered that Unbound, a DNS resolver, does not properly check cryptographic signatures on NSEC3 records. As a result, zones signed with the NSEC3 variant of DNSSEC lose their cryptographic protection. The old stable distribution does not contain an unbound package. For the stable distribution, this problem has been fixed in version 1.0.2-1+lenny1. For the unstable distribution and the testing distribution, this problem has been fixed in version 1.3.4-1. We recommend that you upgrade your unbound package. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1963-1 CVE-2009-3602 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | unbound |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7571 | |||
| Oval ID: | oval:org.mitre.oval:def:7571 | ||
| Title: | DSA-1963 unbound -- cryptographic implementation error | ||
| Description: | It was discovered that Unbound, a DNS resolver, does not properly check cryptographic signatures on NSEC3 records. As a result, zones signed with the NSEC3 variant of DNSSEC lose their cryptographic protection. The old stable distribution does not contain an unbound package. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1963 CVE-2009-3602 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | unbound |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-01-04 | Name : Unbound DNS Server NSEC3 Signature Verification DNS Spoofing Vulnerability File : nvt/unbound_37459.nasl |
| 2009-12-30 | Name : Debian Security Advisory DSA 1963-1 (unbound) File : nvt/deb_1963_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 58836 | Unbound NSEC3 Record Signature Check Validation Bypass Unbound contains a flaw that may allow a malicious user to bypass NSEC3 record signature checks. The issue is triggered when a malicious user sends a specially crafted delegation response in spoofed DNS packets. It is possible that the flaw may allow a secure delegation to be downgraded to insecure resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1963.nasl - Type : ACT_GATHER_INFO |
| 2010-02-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_unbound-100218.nasl - Type : ACT_GATHER_INFO |
| 2010-02-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_unbound-100218.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:29:07 |
|
