PT-2011-4972 · Nlnet · Unbound

Christopher Olah · Published 2011-12-20 · Updated 2012-11-06 · CVE-2011-4528

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Unbound versions prior to 1.4.13p2

Description The issue allows remote DNS servers to cause a denial of service, resulting in a daemon crash, by sending a crafted response with duplicate CNAME records in a signed zone. This occurs due to an attempt to free unallocated memory during the processing of such records.

Recommendations For versions prior to 1.4.13p2, update to version 1.4.13p2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2011-4528

DSA-2370-1

Affected Products

Unbound

References · 11

• http://kb.cert.org/vuls/id/209659 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4528 · Vendor Advisory
• http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt · Vendor Advisory
• http://debian.org/security/2011/dsa-2370 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071535.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4528 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071525.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4528 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4528 · Vendor Advisory
• http://secunia.com/advisories/47326 · Note
• http://osvdb.org/77909 · Note