CVE-2014-8602

Published: Dec 11, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Affected (4)

Products: Nlnetlabs: Unbound · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nlnetlabs Unbound	Up to 1.5.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Related CWEs

CWE-399

References (16)

http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html

Source: cve@mitre.org

Third Party Advisory

http://unbound.net/downloads/patch_cve_2014_8602.diff

Source: cve@mitre.org

Patch

http://www.debian.org/security/2014/dsa-3097

Source: cve@mitre.org

Third Party Advisory

http://www.kb.cert.org/vuls/id/264212

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/71589

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2484-1

Source: cve@mitre.org

Third Party Advisory

https://unbound.net/downloads/CVE-2014-8602.txt

Source: cve@mitre.org

PatchVendor Advisory

http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html