CVE-2020-12662

high-risk

Published 2020-05-19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.

Do I need to act?

15.5% chance of exploitation in next 30 days

EPSS score — higher than 84% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (10)

Unbound

Debian Linux

Leap

Ubuntu Linux

Fedora

Affected Vendors

Debian Canonical Fedoraproject Opensuse Nlnetlabs

References (26)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html

Technical Description http://www.nxnsattack.com

Mailing List http://www.openwall.com/lists/oss-security/2020/05/19/5

Mailing List https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Vendor Advisory https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt

Third Party Advisory https://security.FreeBSD.org/advisories/FreeBSD-SA-20:19.unbound.asc

Third Party Advisory https://security.netapp.com/advisory/ntap-20200702-0006/

Third Party Advisory https://usn.ubuntu.com/4374-1/

Third Party Advisory https://www.debian.org/security/2020/dsa-4694

Third Party Advisory https://www.synology.com/security/advisory/Synology_SA_20_12

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html

Technical Description http://www.nxnsattack.com

Mailing List http://www.openwall.com/lists/oss-security/2020/05/19/5

Mailing List https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

and 6 more references

/ 100

high-risk

Severity 26/34 · High

Exploitability 13/34 · Low

Exposure 16/34 · Moderate