CVE-2019-25035 : What You Need to Know

Unbound before version 1.9.5 contains a disputed flaw in the sldns_bget_token_par function that allows an unauthorized write beyond the allocated memory. The vendor disagrees with classifying this issue as a vulnerability, stating that it cannot be exploited remotely or locally in a running Unbound installation.

Understanding CVE-2019-25035

Unbound vulnerability with disputed classification by the vendor.

What is CVE-2019-25035?

Unbound version 1.9.5 and earlier have a flaw in sldns_bget_token_par allowing unauthorized writes beyond allocated memory.
The vendor disputes the classification of this issue as a vulnerability due to the inability to exploit it remotely or locally.

The Impact of CVE-2019-25035

The disputed vulnerability could potentially lead to unauthorized writes beyond allocated memory.
The vendor's disagreement with the classification may affect the severity and urgency of addressing this issue.

Technical Details of CVE-2019-25035

Details of the vulnerability and affected systems.

Vulnerability Description

Unbound before version 1.9.5 allows an out-of-bounds write in sldns_bget_token_par.
The vendor disputes the vulnerability classification, stating it cannot be remotely or locally exploited.

Affected Systems and Versions

Product: n/a
Vendor: n/a
Versions affected: Up to version 1.9.5

Exploitation Mechanism

The flaw allows unauthorized writes beyond allocated memory but is deemed non-exploitable in running Unbound installations.

Mitigation and Prevention

Steps to address and prevent the vulnerability.

Immediate Steps to Take

Monitor vendor updates and communications regarding the disputed vulnerability.
Consider alternative security measures to mitigate potential risks.

Long-Term Security Practices

Regularly update Unbound to the latest version to address any potential vulnerabilities.
Implement additional security layers to protect against unauthorized writes.

Patching and Updates

Stay informed about any changes in the vendor's stance on the vulnerability.
Apply patches promptly if the vendor reclassifies the issue as a vulnerability.