PT-2019-6122 · Nlnet+8 · Unbound+8

Published 2019-12-11 · Updated 2024-08-05 · CVE-2019-25042

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Unbound versions prior to 1.9.5

Description The issue is related to an out-of-bounds write via a compressed name in the rdata copy function. Although the vendor disputes that this is a vulnerability, the code may be vulnerable. However, a running Unbound installation cannot be remotely or locally exploited. The vulnerability may allow an attacker to access confidential data, disrupt its integrity, and cause a denial of service.

Recommendations For Unbound versions prior to 1.9.5, update to version 1.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the rdata copy function until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2019-3282

ALT-PU-2019-3287

BDU:2021-05838

CESA-2021_1853

CVE-2019-25042

DLA-2652-1

OPENSUSE-SU-2022:0176-1

OPENSUSE-SU-2022_0176-1

RHSA-2021:1853

RHSA-2021_1853

RHSA-2022:0632

RLSA-2021:1853

SUSE-SU-2022:0176-1

SUSE-SU-2022:0176-2

SUSE-SU-2022:0301-1

USN-4938-1

Affected Products

Alt Linux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Unbound

References · 145

• https://errata.rockylinux.org/RLSA-2021:1853 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-25035 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0301-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05865 · Security Note
• https://osv.dev/vulnerability/RLSA-2021:1853 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-25040 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25033 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-3287 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06245 · Security Note
• https://ubuntu.com/security/notices/USN-4938-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18934 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25037 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-25042 · Security Note
• https://bdu.fstec.ru/vul/2022-06885 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25040 · Security Note