CVE-2020-28935

一、漏洞信息
 漏洞编号：[CVE-2020-28935](https://nvd.nist.gov/vuln/detail/CVE-2020-28935)
 漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)
 漏洞归属的版本：1.10.1,1.11.0,1.7.3
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.
 漏洞公开时间：2020-12-08 06:15
 漏洞创建时间：2021-01-20 16:00:29
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2020-28935
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2020-28935 |  |
| nlnetlabs |  https://www.nlnetlabs.nl/downloads/nsd/CVE-2020-28935.txt |  |
| nlnetlabs |  https://www.nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
    NLnet Labs Unbound 1.12.0及之前版本和NLnet Labs NSD 4.3.3及之前版本存在本地符号链接的漏洞。在写PID文件时，如果文件不存在，Unbound和NSD则会创建文件，文件存在则会打开对应文件后写入。当文件存在且恰好为符号链接文件时，就会写入符号链接指向的文件，写入文件之后文件会出现文件属主变更，使得Unbound/NSD成为文件属主。本地攻击者若有Unbound/NSD的用户权限，就可以创建一个符号链接文件代替PID文件，并指向攻击者想要擦除的文件。如果Unbound/NSD被kill掉，且PID文件也没有清理，一旦root权限重启，Unbound/NSD就能重写符号链接指向的任何文件。这个漏洞可能会导致运行Unbound/NSD的系统拒绝服务。触发该漏洞需要攻击者能够获取特殊用户Unbound/NSD的权限，并且通过符号链接指向系统上的致命文件。 
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS(1.11.0):受影响
2.openEuler-20.03-LTS-SP1(1.11.0):受影响
3.openEuler-20.09(1.10.1):受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(1.11.0):
2.openEuler-20.03-LTS-SP3(1.11.0):
3.openEuler-22.03-LTS(1.13.2):
4.openEuler-22.03-LTS-SP1(1.13.2):

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2021-1083

src-openEuler/unbound
关闭

内容风险标识

评论 (7)

src-openEuler/unbound关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2020-28935

评论 (7)

搜索帮助

src-openEuler/unbound
关闭