CyberRota Analysis
AI-GeneratedThe vulnerability affects NLnet Labs Unbound versions 1.6.0 through 1.25.1, specifically in the 'unbound-control' commands that create a local zones tree without including default-protected zones. This oversight allows queries for sensitive names, such as those in RFC 1918 or .localhost, to be resolved via public DNS instead of adhering to local policies, potentially exposing internal network information. Administrators of affected Unbound installations should prioritize addressing this issue to maintain proper DNS query handling and prevent unintended data leakage.
Original NVD Description
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.
Related CVEs
Other vulnerabilities affecting the same vendor(s)