A vulnerability was found in Unbound due to incorrect...
High severity
Unreviewed
Published
Feb 15, 2024
to the GitHub Advisory Database
•
Updated May 18, 2024
Description
Published by the National Vulnerability Database
Feb 15, 2024
Published to the GitHub Advisory Database
Feb 15, 2024
Last updated
May 18, 2024
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.
References