NVD Vulnerability Detail

CVE-2020-12667

Summary	Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.
Publication Date	May 19, 2020, 10:15 p.m.
Registration Date	Jan. 26, 2021, 11:51 a.m.
Last Update	Nov. 21, 2024, 2 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:nic:knot_resolver::::::::					5.1.1

Related information, measures and tools

No	URL	タグ
1	http://cyber-security-group.cs.tau.ac.il/#	Technical Description Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2020/05/19/2	Mailing List Third Party Advisory
3	https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/	Technical Description Vendor Advisory
4	https://lists.debian.org/debian-lts-announce/2024/04/msg00017.html
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76Y4FITMOH6RVPWAANGV7NB2ZHPJJGDQ/
6	https://www.knot-resolver.cz/2020-05-19-knot-resolver-5.1.1.html	Release Notes Vendor Advisory
7	http://cyber-security-group.cs.tau.ac.il/#	Technical Description Third Party Advisory
8	https://www.knot-resolver.cz/2020-05-19-knot-resolver-5.1.1.html	Release Notes Vendor Advisory
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76Y4FITMOH6RVPWAANGV7NB2ZHPJJGDQ/
10	https://lists.debian.org/debian-lts-announce/2024/04/msg00017.html
11	https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/	Technical Description Vendor Advisory
12	http://www.openwall.com/lists/oss-security/2020/05/19/2	Mailing List Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-400	リソースの枯渇	https://cwe.mitre.org/data/definitions/400.html

JVN Vulnerability Information

Knot Resolver におけるリソースの枯渇に関する脆弱性

Title	Knot Resolver におけるリソースの枯渇に関する脆弱性
Summary	Knot Resolver には、リソースの枯渇に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 19, 2020, midnight
Registration Date	June 19, 2020, 10:44 a.m.
Last Update	June 19, 2020, 10:44 a.m.

Affected System

CZ.NIC

Knot Resolver 5.1.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-12667	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12667
National Vulnerability Database (NVD)
2	CVE-2020-12667	https://nvd.nist.gov/vuln/detail/CVE-2020-12667

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-400	https://cwe.mitre.org/data/definitions/400.html

ベンダー情報

No	Name	URL
CZ.NIC
1	NXNSAttack: upgrade resolvers to stop new kind of random subdomain attack	https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/
Knot Resolver
2	Knot Resolver 5.1.1 released	https://www.knot-resolver.cz/2020-05-19-knot-resolver-5.1.1.html

Change Log

No	Changed Details	Date of change
1	[2020年06月19日] 掲載	June 19, 2020, 10:44 a.m.