7.3

CVE-2024-1488

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Unbound Version < 1.19.1-2.fc40
Redhat ≫ Codeready Linux Builder For Arm64 Version 9.0_aarch64
Redhat ≫ Codeready Linux Builder For Arm64 Version 9.2_aarch64
Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Enterprise Linux Version 9.0
Redhat ≫ Enterprise Linux Eus Version 8.6
Redhat ≫ Enterprise Linux Eus Version 8.8
Redhat ≫ Enterprise Linux Eus Version 9.2
Redhat ≫ Enterprise Linux Eus Version 9.4
Redhat ≫ Enterprise Linux For Arm 64 Version 8.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Version 9.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Version 9.2_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version 8.6_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version 8.8_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version 9.4_aarch64
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.249
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.3 1.8 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
RedHat 8 2.5 5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://bugzilla.redhat.com/show_bug.cgi?id=2264183
Patch
Issue Tracking
https://access.redhat.com/errata/RHSA-2024:1750
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1751
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1780
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1801
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1802
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1804
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2587
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2696
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0837
https://access.redhat.com/security/cve/CVE-2024-1488
Third Party Advisory