Cache poisoning via the ECS-enabled Rebirthday Attack
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-349 | CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data |
Type: CWE
Description: CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 4.0 | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/R:U/V:C |
Version: 4.0
Base score: 8.7
Base severity: HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/R:U/V:C
Timeline
| Event | Date |
|---|
| Issue reported by Xiang Li | 2025-01-02 00:00:00 |
| Issue acknowledged by NLnet Labs | 2025-01-03 00:00:00 |
| Mitigation shared with Xiang Li | 2025-01-08 00:00:00 |
| Fix released with Unbound 1.23.1 (coordinated with other vendors) | 2025-07-16 00:00:00 |
Event: Issue reported by Xiang Li
Date: 2025-01-02 00:00:00
Event: Issue acknowledged by NLnet Labs
Date: 2025-01-03 00:00:00
Event: Mitigation shared with Xiang Li
Date: 2025-01-08 00:00:00
Event: Fix released with Unbound 1.23.1 (coordinated with other vendors)
Date: 2025-07-16 00:00:00