CVE-2024-1488: fedoraproject unbound Incorrect Default Permissions

Vulnerability summary

CVE-2024-1488 is a high (CVSS 8.0) Incorrect Default Permissions vulnerability in fedoraproject unbound. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.5% of scored vulnerabilities.

Timeline

1. 15-02-2024
   PublishedVulnerability first disclosed.
2. 06-08-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

• CWE-276Incorrect Default PermissionsDuring installation, installed file permissions are set to allow anyone to modify those files.