发布日期：2009-10-07
更新日期：2009-12-30

受影响系统：

Unbound Unbound 1.3.3

不受影响系统：

Unbound Unbound 1.3.4

描述：

---

BUGTRAQ  ID: 37459
CVE(CAN) ID: CVE-2009-3602

Unbound是开源的递归式DNS服务器软件。

Unbound在处理NSEC3记录时没有正确地检查其加密签名。远程攻击者可以在伪造的DNS报文中使用特制的委托响应来利用这个漏洞，绕过NSEC3签名检查将已建立的安全委托降级为不安全。

<*来源：Wouter
  
  链接：http://secunia.com/advisories/36996/
        http://www.debian.org/security/2009/dsa-1963
*>

建议：

---

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-1963-1）以及相应补丁:
DSA-1963-1：New unbound packages fix DNSSEC validation
链接：http://www.debian.org/security/2009/dsa-1963

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2.orig.tar.gz
Size/MD5 checksum:  3597275 01b08a9c0d24be981de64b6e4e25ecbe
http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1.diff.gz
Size/MD5 checksum:    11066 b003007bc954f8877791de9e22c3c146
http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1.dsc
Size/MD5 checksum:     1436 9e83801b9223c4ac8535243f880044a8

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_alpha.deb
Size/MD5 checksum:   320244 9482874b056753f0082025d8735643f5
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_alpha.deb
Size/MD5 checksum:    12738 034c9f659508551082c0411307b9c502
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_alpha.deb
Size/MD5 checksum:   215888 4cd1a8ae7cfb61d917b99267746f1877
http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_alpha.deb
Size/MD5 checksum:   381560 d89de99e20d73980efb5031fe70f06ff

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_amd64.deb
Size/MD5 checksum:   200256 a7c7cd577f7271a63abac791dbf1469b
http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_amd64.deb
Size/MD5 checksum:   358126 86bab87ab0f5d5cdb94057dc9bc4ea2d
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_amd64.deb
Size/MD5 checksum:    12266 babd3fec31c85a5ff91080e44504a4cf
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_amd64.deb
Size/MD5 checksum:   235494 e7e814a39e5524c8e64134cdbfd4dce9

arm architecture (ARM)

http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_arm.deb
Size/MD5 checksum:    11892 139bd5b0186a6187c6a8283330bff6ae
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_arm.deb
Size/MD5 checksum:   179624 44c9d6c40987ea1d02f70615f4bf1d6d
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_arm.deb
Size/MD5 checksum:   210562 c81ae06d74c86ca42d85481065fa7133
http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_arm.deb
Size/MD5 checksum:   334640 f5693d14213e4118eec1b93d29e13e2f

armel architecture (ARM EABI)

http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_armel.deb
Size/MD5 checksum:   331972 00e1c301c73ea80752c6d2f93e3ac521
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_armel.deb
Size/MD5 checksum:   178740 f39e019eee3b4c54380d9a065f9a2621
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_armel.deb
Size/MD5 checksum:    11850 0726a83164dee4ee7abac8101249bf1a
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_armel.deb
Size/MD5 checksum:   209640 904f538ef4d6c3b2ee199c255fd7bbc5

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_hppa.deb
Size/MD5 checksum:   207560 af33e156e79347ed6d7b791b4f257524
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_hppa.deb
Size/MD5 checksum:   260268 27d99bddc430f56a283897bbfbbbbafe
http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_hppa.deb
Size/MD5 checksum:   377250 8887398b373794cdbe669c2ecf41ad39
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_hppa.deb
Size/MD5 checksum:    12810 d5686532a7612faaf4b1de58957bb7c4

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_i386.deb
Size/MD5 checksum:    11938 0431937c6253cedf452ddb0227f93cb2
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_i386.deb
Size/MD5 checksum:   186228 9e1c7aa0b3b5c43435a0a3d402ddc062
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_i386.deb
Size/MD5 checksum:   207836 933044378c345e44d57b95ae6aaebee5
http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_i386.deb
Size/MD5 checksum:   333658 777eb04b75e53b2eeeb83446cc91313c

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_ia64.deb
Size/MD5 checksum:   495470 2fbc1a857aab0008d3397f6cffe0d6e0
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_ia64.deb
Size/MD5 checksum:   336702 8b5bdaac3cfd2f6f932d2751b025a2af
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_ia64.deb
Size/MD5 checksum:    14356 d81133f39d102425ab8860751e50d5bd
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_ia64.deb
Size/MD5 checksum:   270068 2e6860fdf2c35adbd8d36bd671e2a6ac

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_mips.deb
Size/MD5 checksum:   363468 e52ee62e28ec76119133aa85751cad82
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_mips.deb
Size/MD5 checksum:   258186 d7a48e7895f10d5daae90756e1f992af
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_mips.deb
Size/MD5 checksum:   184786 e8b44c5bf399601e7b361241d6e75ea4
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_mips.deb
Size/MD5 checksum:    11994 fa14dcef4206f545162eadb5e5105966

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_mipsel.deb
Size/MD5 checksum:   255822 c3c2c805745d627df87db1d042641445
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_mipsel.deb
Size/MD5 checksum:    12040 993713e7f0fa831dd703ffd626e1d60e
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_mipsel.deb
Size/MD5 checksum:   182534 1d279a306fb2a9e7f3de110c846104aa
http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_mipsel.deb
Size/MD5 checksum:   359236 3d3342777414135d94d26190da032d6c

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_powerpc.deb
Size/MD5 checksum:   359150 ffadb6a8602493bb90eae81cdc88506d
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_powerpc.deb
Size/MD5 checksum:   240514 ac86e3a4653450b6e7b790484dec5eea
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_powerpc.deb
Size/MD5 checksum:   207604 104ee743c6be3bde389386f9ee99ccf9
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_powerpc.deb
Size/MD5 checksum:    14950 4ac8e2623b5f69213f52184a94927aca

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_s390.deb
Size/MD5 checksum:   375566 b4a618cde1434867d7d3f4c51b15588b
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_s390.deb
Size/MD5 checksum:   207636 1af11fd95321e6a1e36c0217a6891b55
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_s390.deb
Size/MD5 checksum:   233232 9d239915eab5a7ac94dc45c900225ae7
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_s390.deb
Size/MD5 checksum:    12728 6245613210b76778257906493903c47b

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/u/unbound/unbound_1.0.2-1+lenny1_sparc.deb
Size/MD5 checksum:   330738 12513df68b7e408cdad4863629d08ed4
http://security.debian.org/pool/updates/main/u/unbound/libunbound-dev_1.0.2-1+lenny1_sparc.deb
Size/MD5 checksum:   218752 25f95e3756644e92c950e0d8248ba541
http://security.debian.org/pool/updates/main/u/unbound/libunbound0_1.0.2-1+lenny1_sparc.deb
Size/MD5 checksum:   184136 4177a529c2c6fc422cbb74863390370b
http://security.debian.org/pool/updates/main/u/unbound/unbound-host_1.0.2-1+lenny1_sparc.deb
Size/MD5 checksum:    12356 4d4e6d0c96e7263372c233368cc4f69a

补丁安装方法：

1. 手工安装补丁包：

  首先，使用下面的命令来下载补丁软件：
  # wget url  (url是补丁下载链接地址)

  然后，使用下面的命令来安装补丁：  
  # dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

   首先，使用下面的命令更新内部数据库：
   # apt-get update
  
   然后，使用下面的命令安装更新软件包：
   # apt-get upgrade

Unbound
-------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://unbound.net/pipermail/unbound-users/2009-October/000852.html

浏览次数：3560
严重程度：0（网友投票）