CVE-2014-8602

2014-12-1102:59:03

CWE-399

mitre

web.nvd.nist.gov

cve-2014-8602

unbound

nlnet labs

denial of service

memory consumption

cpu consumption

remote attackers

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

AI Score

6.3

Confidence

Low

EPSS

0.59

Percentile

97.8%

JSON

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Affected configurations

Nvd

Node

nlnetlabsunboundRange≤1.5.0

Node

canonicalubuntu_linuxMatch14.04lts

canonicalubuntu_linuxMatch14.10

Node

debiandebian_linuxMatch7.0

VendorProductVersionCPE
nlnetlabsunbound*cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*
canonicalubuntu_linux14.04cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
canonicalubuntu_linux14.10cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
debiandebian_linux7.0cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nlnetlabs	unbound	*	cpe:2.3:a:nlnetlabs:unbound::::::::
canonical	ubuntu_linux	14.04	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
canonical	ubuntu_linux	14.10	cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*
debian	debian_linux	7.0	cpe:2.3:o:debian:debian_linux:7.0:::::::*