CVE-2014-8602

What it actually does

Unbound's iterator.c lacks limits on delegation chaining during DNS resolution, permitting an attacker to force the resolver to follow arbitrarily long or cyclic referral chains that exhaust memory and CPU.

Why it matters to the business

DNS resolution services can be rendered unavailable, interrupting name resolution for applications and users across the network until the server is restarted or the attack stops.

How an attack unfolds

An attacker sends a single DNS query engineered to return an unbounded chain of referrals; the resolver dutifully follows each referral, allocating resources at every step until memory or CPU is exhausted and the service becomes unresponsive.

How to fix it

Upgrade NLnet Labs Unbound to version 1.5.1 or later; apply the corresponding security updates provided by Canonical Ubuntu and Debian package maintainers.

How to confirm the fix worked

Confirm the installed Unbound binary reports version 1.5.1 or newer; replay a controlled delegation-chain test query in a lab environment and verify that resource usage remains bounded.

Typical attack path

1. Craft a DNS query that triggers an infinite or very long referral chain
2. Send the query to the target Unbound resolver
3. Observe progressive resource consumption on the resolver
4. Continue or repeat queries until service degradation or crash occurs

How to detect it

Inspect DNS query logs and system resource metrics for sudden spikes in resolver activity or memory usage correlated with queries containing repeated or unusual referral patterns.

What your security team should do

• Prioritize upgrade of all Unbound instances to 1.5.1+ within maintenance windows
• Review and tighten any ACLs that permit recursive queries from untrusted sources
• Enable query logging and resource monitoring to detect anomalous referral patterns