Penetration Test Report (X41 D-Sec): X41 Unbound Security Audit 2019 Final Report

SourceCodeAuditonUnboundDNSServer
forNLnetLabs
FinalReportandManagementSummary
2019-12-09
PUBLIC
X41 D-SEC GmbH
Dennewartstr. 25-27
D-52068 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
Organized by the Open Source Technology Improvement Fund
SourceCodeAuditonUnboundDNSServer NLnetLabs
Revision Date Change Author(s)
1 2019-09-11 InitialReport E.Sesterhenn
2 2019-11-10 Findings E.Sesterhenn,L.Merino,M.Vervier
3 2019-11-10 FirstDraft E.Sesterhenn,L.Merino,M.Vervier
4 2019-11-22 Findings Documen- E. Sesterhenn, L. Gommans, L. Merino,
tation M.Vervier,N.Abel
5 2019-12-02 FinalReport E.Sesterhenn,M.Vervier
6 2019-12-06 IncludeFixes E.Sesterhenn,M.Vervier
X41D-SecGmbH PUBLIC Page1of88
SourceCodeAuditonUnboundDNSServer NLnetLabs
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 TechnicalSummary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.4 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3 RatingMethodologyforSecurityVulnerabilities 12
3.1 CommonWeaknessEnumeration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4 Results 14
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.2 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
4.3 SideFindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
5 AboutX41D-SecGmbH 87
X41D-SecGmbH PUBLIC Page2of88
SourceCodeAuditonUnboundDNSServer NLnetLabs
Dashboard
Target
Customer NLnetLabs
Name UnboundDNSServer
Type SourceCode
Version Commitb60c4a472c856f0a98120b7259e991b3a6507eb5
Engagement
Type SourceCodeAudit
5:EricSesterhenn,LucGommans,LuisMerino,MarkusVervier,
Consultants
andNiklasAbel
EngagementEffort 44person-days,2019-09-11to2019-11-26
Totalissuesfound 25
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of88
SourceCodeAuditonUnboundDNSServer NLnetLabs
1 Executive Summary
BetweenAugustandNovember2019,X41D-SecGmbHperformedaSourceCodeAuditagainst
UnboundDNSServerofNLnetLabs. ThisauditwassponsoredbytheOpenSourceTechnology
ImprovementFund.
Atotalof25vulnerabilitieswerediscoveredduringthetestbyX41.Onewasratedascritical,five
wereclassifiedashighseverity,fiveasmedium,and14aslow. Additionally,25issueswithouta
directsecurityimpactwereidentified.
Figure1.1:IssuesandSeverity
A combination of manual code auditing, dynamic analysis using a custom fuzzing harness, and
staticanalysiswasusedtoperformtheaudit.
X41D-SecGmbH PUBLIC Page4of88
SourceCodeAuditonUnboundDNSServer NLnetLabs
Thetestersreceivedallavailableinformationabouttheproject,includingsourcecode. Thetest
wasperformedbyfiveexperiencedsecurityexpertsbetween2019-09-11and2019-11-26.
Themostsevereissuediscoveredallowsanattackertoexecutecommandsontheunboundserver
by abusing a command injection in the IPSECMOD module via a malicious DNS response. Ad-
ditionally, various memory safety issues have been identified, some of which could also allow
remotecodeexecutionbyhijackingthecontrolflowoftherunningservice.
Severalintegeroverflowshavebeendetected,andthecodeshouldbehardenedagainstthesein
severalplaces.Furthermore,theuseofrandomnessisnotoptimalincertaincornercases.
Thisreportcontainsahighnumberofsidefindings, thatshowpartswherepotentialfuturevul-
nerabilitiescouldariseandhardeningcouldbeappliedtoimprovethecodequalityfurther.
NLNet Labs was very supportive during the audit, all questions were answered and the issues
identifiedresolvedquickly.
X41recommendstoperformcontinuousandimprovedfuzzingtestsagainstthecode,sincethe
currentapproachwillnotprovidefullcoverageofcodeanddataflows.
Inthetimegiven,X41wasabletoidentifyanumberofflawsinthesoftwareandplaceswhere
furtherhardeningcouldbeapplied.
X41D-SecGmbH PUBLIC Page5of88
SourceCodeAuditonUnboundDNSServer NLnetLabs
2 Introduction
X41reviewedthecomponentsoftheunboundDNS1serverwithateamoffivesecurityexperts.
UnboundplaysacentralroleintheInternetinfrastructurebybeingthedefaultcachingresolverin
operatingsystemssuchasFreeBSDandOpenBSD.GainingcontroloversuchaDNSserverwould
allowanattackertoperformfurtherattacksandmighthelpwithphishingormalwaredistribution.
TherearetwoprimarywaysinwhichattackerscouldtrytoattacktheDNSservers:
1. BysendingitDNSrequests;
2. byansweringrequestsinamaliciousmanner.
UnboundisalreadypartoftheOSS-Fuzzproject2 whereitiscontinuouslyfuzz-tested. Further-
more,UnboundissubjecttoCoverityscans3 andseemstobetestedwithLLVMscan-build4 reg-
ularly. Furthermore, acomprehensivetest suiteis availablethatismostly testingforfunctional
defects.
X41 extended this fuzz testing using an internal fuzz testing harness and was able to identify
furthervulnerabilities,notyetcaughtbytheexistingfuzzingoperations.
1DomainNameSystem
2https://github.com/google/oss-fuzz/tree/master/projects/unbound
3https://scan.coverity.com/projects/unbound
4https://clang-analyzer.llvm.org/scan-build.html
X41D-SecGmbH PUBLIC Page6of88
SourceCodeAuditonUnboundDNSServer NLnetLabs
2.1 Technical Summary
X41analyzedvariousaspectsandattackvectorssuchaswellknownDNSattacks.
DNS cache poisoning is thwarted by generating query identifiers and source ports with secure
random number generators (CSPRNGs5), and because an attacker can only do a few attempts
per day due to the TTL6. Aside from a few system ports, a large portion of the available port
range is used (close to 60.000), making the probability of guessing the source port and query
identifiercloseto1/232.Anattackermightbeabletoinsertafewhundredresponsesbeforethe
legitimateresponsearrives, butthen needsto waituntilthe TTLexpires. Moreover, andunlike
BIND,Unboundimplemented0x20randomization7,thoughitisdisabledbydefault.
Unbound requires by default DNSSEC8 data for trust-anchored zones to harden against DNS
entrymanipulation. ItonlyusesNXDOMAIN entriesasaproof9 thattherearenosubdomainsun-
derneath,whentheyaresecuredbyDNSSEC. UnboundcanbeconfiguredtoenforceDNSSEC
validationonnameserversetsandthenameserveraddressesthatareencounteredonthereferral
pathtotheanswerofqueries. Unboundcanbeprotectedagainstalgorithmdowngradeswhen
multiplealgorithmsaredefined.Thisisdisabledinthedefaultconfigurationtocircumventissues
with zones which cannot be validated properly. By default, Unbound only trusts glue entries if
theyarewithinaserver’sauthority.
Denialofserviceattackscanbebroadlycategorizedintwosections:
1. Denial of service attacks against the server itself, attempting to take the server down or
otherwisemakeitrefusequeriestolegitimateclients.
2. Reflected (amplified) denial of service attacks, where the DNS server (the reflector) per-
formstheattackonbehalfoftheattacker.
Againstgeneraldenialofserviceattacks, Unboundhasahardeningoptionregardingverysmall
EDNS10 buffersizesthatcanbeignoredthroughtheflagharden-short-bufsize,largequeries
canbefilteredthroughharden-large-queries.
To thwart amplification attacks, Unbound offers the configuration option ip-ratelimit, which
is disabled by default. This limits the number of queries per second accepted per IP11 address,
dropping any queries in excess of the limit. A downside of this method is that an attacker can
5CryptographicallySecurePseudoRandomNumberGenerators
6TimetoLive
7https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
8DomainNameSystemSecurityExtensions
9https://tools.ietf.org/html/rfc8020
10ExtendedDNS
11InternetProtocol
X41D-SecGmbH PUBLIC Page7of88
SourceCodeAuditonUnboundDNSServer NLnetLabs
denyalegitimateclientfromresolvingnames,sincetheycanspooftheirIPaddressandensure
thequeryrateisconstantlyabovethelimit.Insteadofpreventingtheattack,theoptionlimitsthe
strengthofit:anattackercanstilltriggertrafficbeingcontinuouslysenttothevictim,albeitata
lowerrate.Bypoolingenoughservers,whichanattackerwoulddoregard