BSD Portsunbound -- Cache poisoning via the ECS-enabled Rebirthday Attack
[email protected] reports: A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or …
Affected versions
- unbound > 1.6.1 < 1.23.0
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | dns/unbound | 1.26.2 | fixed | (372 days after) |
| MidnightBSD | dns/unbound | 1.26.1 | out of range, by version | |
| DragonFly | dns/unbound | 1.22.0_1 | vulnerable since 2025-07-18 |