Project

General

Profile

Actions

Bug #9708

closed

/etc/inc/unbound.inc: Pfsense Default Unbound Configuration does not Prevent DNS Rebinding Attacks Against Localhost

Added by Ben Tice over 4 years ago. Updated over 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
DNS Resolver
Target version:
Start date:
08/28/2019
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.4-p3
Affected Architecture:
All

Description

By default Unbound attempts to prevent DNS rebinding attacks by stripping private (RFC1819) addresses out of DNS responses. DNS rebinding attacks can also be launched against localhost/loopback addresses. By default the Unbound configuration that Pfsense ships does not include localhost/loopback addresses in the list of "Private addresses" Unbound should strip out. This means a DNS rebinding attack against a loopback address will not be prevented even when "DNS Rebinding Checks" are enabled (Which is the default). An example of an attack chain that leverages DNS rebinding against loopback is this RCE against Blizzard's Battle.Net application: https://bugs.chromium.org/p/project-zero/issues/detail?id=1471​. A more recent example involving stealing cryptocurrency is https://blog.ret2.io/2019/08/28/sia-coin-dns-rebinding/​.

This can be resolved by adding "private-address: 127.0.0.0/8" to the list of private addresses in "/etc/inc/unbound.inc" (https://github.com/pfsense/pfsense/blob/master/src/etc/inc/unbound.inc).

Actions #1

Updated by Jim Pingle over 4 years ago

  • Assignee set to Jim Pingle
  • Target version set to 2.5.0
Actions #2

Updated by Jim Pingle over 4 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100
Actions #3

Updated by Viktor Gurov over 4 years ago

Jim Pingle wrote:

Applied in changeset afeb18ff0ecaec2e9d0da1801fe9cebf5b99a3ca.

Tested on 2.5.0.a.20191011.1853

# cat /etc/inc/unbound.inc | grep "private-address: 127.0.0.0/8" 
private-address: 127.0.0.0/8
# cat /var/unbound/unbound.conf | grep "private-address: 127.0.0.0/8" 
private-address: 127.0.0.0/8

Resolved

Actions #4

Updated by Jim Pingle over 4 years ago

  • Status changed from Feedback to Resolved
Actions #5

Updated by Jim Pingle over 4 years ago

  • Target version changed from 2.5.0 to 2.4.5
Actions #6

Updated by Jim Pingle over 4 years ago

  • Status changed from Resolved to Feedback

Needs checked and/or tested again on 2.4.5 snapshots

Actions #7

Updated by Jim Pingle over 4 years ago

  • Status changed from Feedback to Resolved

New value is present on 2.4.5.a.20191217.0637

grep -r private-address /var/unbound/*
unbound.conf:private-address: 127.0.0.0/8
[...]
Actions

Also available in: Atom PDF