In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate labels secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in harden-below-nxdomain logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. harden-below-nxdomain does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apexs immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private namespace nested two or more labels under a signed public name, the walk returns it and the configured stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone).
Weakness
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Unbound | Nlnetlabs | 1.13.2 (including) | 1.25.2 (excluding) |
| Red Hat Hardened Images | RedHat | unbound-main-1.25.2-0.1.hum1 | * |
| Unbound | Ubuntu | upstream | * |