PT-2022-6740 · Nlnet+10 · Unbound+10

Xiang Li · Published 2022-08-01 · Updated 2024-06-11 · CVE-2022-30699

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.16.1 and earlier

Description The issue is related to a novel type of the "ghost domain names" attack, where an Unbound instance is targeted. The attack works by querying Unbound for a rogue domain name when the cached delegation information is about to expire. A rogue nameserver delays the response, causing the cached delegation information to expire. Upon receiving the delayed answer, Unbound overwrites the now expired entries, allowing the rogue delegation information to be ever-updating.

Recommendations Update to version 1.16.2 or later to fix the issue. As a temporary workaround, consider restricting access to the Unbound instance to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

ALSA-2022:7622

ALSA-2022:8062

ALT-PU-2022-2656

ALT-PU-2022-2684

ALT-PU-2022-2700

ALT-PU-2023-7205

AZL-10453

BDU:2023-03845

CESA-2022_7622

CVE-2022-30699

DLA-3371-1

MGASA-2022-0303

OESA-2022-1836

RHSA-2022:7622

RHSA-2022:8062

RHSA-2022_7622

RHSA-2022_8062

RHSA-2024:2045

RLSA-2022:7622

RLSA-2022:8062

SUSE-SU-2024:1923-1

SUSE-SU-2024:1991-1

SUSE-SU-2024:1991-2

USN-5569-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Unbound

References · 94

• https://osv.dev/vulnerability/SUSE-SU-2024:1923-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5569-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3371-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10453 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:8062 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-30699 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2022-8062.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30699 · Vendor Advisory
• https://nlnetlabs.nl/downloads/unbound/CVE-2022-30698_CVE-2022-30699.txt · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-30699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30698 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1991-2 · Vendor Advisory
• https://security.gentoo.org/glsa/202212-02 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5569-1 · Vendor Advisory