CVE-2020-12662
📋 TL;DR
CVE-2020-12662 is a DNS amplification vulnerability in Unbound DNS resolver where attackers can trigger random subdomain queries via malicious NS records, causing denial of service through resource exhaustion. This affects any system running vulnerable Unbound versions as a DNS resolver. The attack exploits insufficient control over network message volume.
💻 Affected Systems
- Unbound DNS resolver
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Unbound by Nlnetlabs
⚠️ Risk & Real-World Impact
Worst Case
Complete DNS resolver unavailability due to resource exhaustion, disrupting all DNS resolution for dependent systems and potentially causing cascading network failures.
Likely Case
Degraded DNS performance, increased latency, and intermittent service disruptions affecting applications relying on DNS resolution.
If Mitigated
Minimal impact with proper rate limiting, query validation, and updated software.
🎯 Exploit Status
Attack requires sending specially crafted DNS queries with malicious NS records. The nxnsattack.com website demonstrates the technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.1 and later
Vendor Advisory: https://nlnetlabs.nl/projects/unbound/security-advisories/
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Unbound service. 3. Update to Unbound 1.10.1 or later via package manager or source compilation. 4. Restart Unbound service. 5. Verify service is running and resolving correctly.
🔧 Temporary Workarounds
Rate limiting configuration
linuxConfigure aggressive rate limiting to reduce impact of amplification attacks
Add to unbound.conf: server: ratelimit: 1000
Add to unbound.conf: server: ratelimit-size: 4m
Query validation hardening
linuxConfigure stricter validation of incoming DNS queries
Add to unbound.conf: server: val-permissive-mode: no
Add to unbound.conf: server: val-clean-additional: yes
🧯 If You Can't Patch
- Implement network-level rate limiting using firewall rules to limit DNS query volume
- Deploy DNS query filtering/proxying solution in front of vulnerable Unbound instances
🔍 How to Verify
Check if Vulnerable:
Check Unbound version with: unbound -V | grep versionCheck Version:
unbound -VVerify Fix Applied:
Verify version is 1.10.1 or higher: unbound -V | grep 'version 1\.1[0-9]\|version [2-9]'📡 Detection & Monitoring
Log Indicators:
- Unusual spike in DNS queries
- Multiple queries for random subdomains
- High CPU/memory usage in Unbound logs
Network Indicators:
- Abnormal DNS query patterns with random subdomains
- DNS amplification traffic from internal resolvers
SIEM Query:
source="unbound.log" AND ("query" AND "random" OR "NXNS" OR "amplification")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html
- http://www.nxnsattack.com
- http://www.openwall.com/lists/oss-security/2020/05/19/5
- https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ42N2HBZ3DXMSEC56SWIIOFQGOS5M7I/
- https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:19.unbound.asc
- https://security.netapp.com/advisory/ntap-20200702-0006/
- https://usn.ubuntu.com/4374-1/
- https://www.debian.org/security/2020/dsa-4694
- https://www.synology.com/security/advisory/Synology_SA_20_12
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html
- http://www.nxnsattack.com
- http://www.openwall.com/lists/oss-security/2020/05/19/5
- https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ42N2HBZ3DXMSEC56SWIIOFQGOS5M7I/
- https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:19.unbound.asc
- https://security.netapp.com/advisory/ntap-20200702-0006/
- https://usn.ubuntu.com/4374-1/
- https://www.debian.org/security/2020/dsa-4694
- https://www.synology.com/security/advisory/Synology_SA_20_12
