CVE-2020-12662 log

Severity High
Remote Yes
Type Denial of service
An issue has been found in unbound before 1.10.1, that makes it possible to have a single incoming query result in a large number of outgoing queries. This amplification makes it possible for Unbound to be used in a denial of service attack. The researchers discovering this called this attack the NXNSattack.This attack makes use of cache bypassing using random subdomains in the NSDNAME in NS records. When these delegation records are received during iteration, and the answer does not contain glue records, a resolver has to send out a query to the get the IP address for one of the names. When this query fails (for example because the random name does not exist) a resolver will try the next one. A large set of NS records with random names can result in a large number of outgoing queries going to the same target.
Group Package Affected Fixed Severity Status Ticket
AVG-1164 unbound 1.10.0-2 1.10.1-1 High Fixed
Date Advisory Group Package Severity Type
20 May 2020 ASA-202005-14 AVG-1164 unbound High denial of service