Skip to content
OriginalSign in
Image: The Hacker News

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Critical Unbound DNSSEC Flaw Lets Attackers Execute Code via DNS

Part of the DNSSEC story · since 10 Sep

Quiet for 6 weekslast report 17 Sep3 articles3 outlets
10 Sep · Cloudflare first7 Oct16 Oct25 OctNowThis article3rd of 3
  • Thu 10 Sep, 13:26 UTC. Cloudflare, first report. Cloudflare Tests Post Quantum DNSSEC with Oversized Signatures.
  • Thu 17 Sep, 11:54 UTC. SecurityOnline, its first report on the story. Unbound 1.26.1 Fixes Critical DNSSEC Flaw and RCE Risks.
  • Thu 17 Sep, 14:11 UTC. The Hacker News, its first report on the story. Critical Unbound DNSSEC Flaw Lets Attackers Execute Code via DNS. This article, 3rd of 3.

The article discusses a critical vulnerability found in the Unbound DNSSEC validator, which could allow remote code execution (RCE) through a malicious DNS zone. The flaw raises serious concerns regarding DNS security. The piece emphasizes the importance of patching and securing DNS servers to mitigate potential exploitation risks. It targets systems using the affected DNS software version and highlights potential impacts on organizations relying on DNSSEC for secure domain name resolution.

How the story developed

All 3 articles
Quiet for 6 weekslast report 17 Sep3 articles3 outlets

3 articles from 3 outlets since 10 Sep. Quiet since 17 Sep. This was the 3rd report, 7 days after the first.

Now10 Sep12131415161718First reportCloudflare · 10 Sep, 13:26This article3rd of 3 · day 7
  • Thu 10 Sep, 13:26 UTC. Cloudflare, first report. Cloudflare Tests Post Quantum DNSSEC with Oversized Signatures.
  • Thu 17 Sep, 11:54 UTC. SecurityOnline, its first report on the story. Unbound 1.26.1 Fixes Critical DNSSEC Flaw and RCE Risks.
  • Thu 17 Sep, 14:11 UTC. The Hacker News, its first report on the story. Critical Unbound DNSSEC Flaw Lets Attackers Execute Code via DNS. This article, 3rd of 3.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Thu 10 SepDay 01
    1. Cloudflare Tests Post Quantum DNSSEC with Oversized Signatures13:26 · Cloudflare · First report

  2. Quiet for 7 days

    Thu 17 SepDay 72
    1. Unbound 1.26.1 Fixes Critical DNSSEC Flaw and RCE Risks11:54 · SecurityOnline · Picked up again
    2. Critical Unbound DNSSEC Flaw Lets Attackers Execute Code via DNS14:11 · The Hacker News · This article, 3rd of 3

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in