Incorrect Default Permissions Affecting unbound-devel package, versions <0:1.16.2-5.8.el8_10


Severity

Recommended
0.0
high
0
10

Based on AlmaLinux security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Incorrect Default Permissions vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ALMALINUX8-UNBOUNDDEVEL-6611135
  • published12 Apr 2024
  • disclosed30 Jan 2025

Introduced: 12 Apr 2024

CVE-2024-1488  (opens in a new tab)
CWE-276  (opens in a new tab)

How to fix?

Upgrade AlmaLinux:8 unbound-devel to version 0:1.16.2-5.8.el8_10 or higher.
This issue was patched in ALSA-2025:0837.

NVD Description

Note: Versions mentioned in the description apply only to the upstream unbound-devel package and not the unbound-devel package as distributed by AlmaLinux. See How to fix? for AlmaLinux:8 relevant fixed versions and status.

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

CVSS Scores

version 3.1