Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2020-12662

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.

VectorNETWORK

PublishedMay 19, 2020, 14:15

Published Bycve@mitre.org

Base Score

Score7.5

Affected Versions

No affected versions found.

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html
http://www.nxnsattack.com
http://www.openwall.com/lists/oss-security/2020/05/19/5
https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ42N2HBZ3DXMSEC56SWIIOFQGOS5M7I/
https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:19.unbound.asc
https://security.netapp.com/advisory/ntap-20200702-0006/
https://usn.ubuntu.com/4374-1/
https://www.debian.org/security/2020/dsa-4694
https://www.synology.com/security/advisory/Synology_SA_20_12

Weakness Type

CWE-400

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK