https://lists.nlnetlabs.nl/pipermail/unbound-users/2024-August/008377.html announces the release of version 1.21.0 of this DNS server, including:
This release has a fix for the CAMP and CacheFlush issues. They have a low severity for Unbound, since it does not affect Unbound so much. The Compositional Amplification (CAMP) type of attacks can lead to DoS attacks against DNS servers. In Unbound legitimate client requests to the resolvers under typical workload are not directly affected by CAMP attacks. However we introduce a global quota for 128 outgoing packets per query (and it's subqueries) that is never reset to prevent the combination of CAMP with other amplification attacks in the future. We would like to thank Huayi Duan, Marco Bearzi, Jodok Vieli, and Cagin Tanir from NetSec group, ETH Zurich for discovering and notifying us about the issue.
This appears to refer to: https://www.usenix.org/conference/usenixsecurity24/presentation/duan
The CacheFlush type of attacks (NSCacheFlush, CNAMECacheFlush) try to evict cached data by utilizing rogue zones and a steady rogue stream to a resolver. Based on the zone, the stream, the configured cache size and the legitimate traffic, Unbound could experience a degradation of service if a useful entry is evicted and Unbound needs to resolve again. As a mitigation to the NSCacheFlush attack Unbound is setting a limit of 20 RRs in an NS RRset. We would like to thank Yehuda Afek, Anat Bremler-Barr, Shoham Danino and Yuval Shavitt (Tel-Aviv University and Reichman University) for discovering and notifying us about the issue.
This appears to refer to: https://www.usenix.org/conference/usenixsecurity24/presentation/afek
- Fix #1071: [FR] Clear both in-memory and cachedb module cache with `unbound-control flush*` commands.
This appears to have been assigned CVE-2024-43167: https://www.cve.org/CVERecord?id=CVE-2024-43167 -- -Alan Coopersmith- alan.coopersm...@oracle.com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
