Published: 03/10/2019 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Unbound prior to 1.9.4 accesses uninitialized memory, which allows remote malicious users to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.

Vulnerable Product	Search on Vulmon	Subscribe to Product
nlnetlabs unbound
canonical ubuntu linux 19.04

Debian Bug report logs - #941692 unbound: CVE-2019-16866 Package: src:unbound; Maintainer for src:unbound is unbound packagers <unbound@packagesdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 3 Oct 2019 20:39:01 UTC Severity: important Tags: security, upstream Found in versions unboun ...

Unbound could be made to crash if it received a specially crafted NOTIFY query ...

X41 D-Sec discovered that unbound, a validating, recursive, and caching DNS resolver, did not correctly process some NOTIFY queries This could lead to remote denial-of-service by application crash For the stable distribution (buster), this problem has been fixed in version 190-2+deb10u1 We recommend that you upgrade your unbound packages For ...

Due to an error in parsing NOTIFY queries, it is possible for Unbound from 171 up to and including 193 to continue processing malformed queries and may ultimately result in a pointer dereference in uninitialized memory This results in a crash of the Unbound daemon ...

CWE-755 CWE-908 https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt https://usn.ubuntu.com/4149-1/https://www.debian.org/security/2019/dsa-4544 https://seclists.org/bugtraq/2019/Oct/23 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941692 https://usn.ubuntu.com/4149-1/https://nvd.nist.gov

CVE-2019-16866

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect