CVE-2024-1488 describes a security flaw in Unbound where incorrect default permissions on the control interface allow any local process outside the unbound group to modify the running instance's configuration. Specifically, when 'control-use-cert' is set to 'no' combined with use of an IP address in 'control-interface', processes connecting to localhost on port 8953 can alter unbound's runtime settings. This can lead to manipulation of DNS forwarders, enabling query tracking or disruption of DNS resolution. Red Hat's advisory (RHSA-2024:1750) addresses this by adding a new configuration file '/etc/unbound/conf.d/remote-control.conf' with directives to restrict control access to a Unix socket and enforce certificate usage. Users are advised to update unbound and adjust configurations accordingly to mitigate the issue.

An unprivileged local process can connect to the unbound control interface and modify its runtime configuration. This can allow attackers to change DNS forwarders, potentially enabling monitoring of DNS queries or causing DNS resolution failures. The impact is local privilege misuse leading to potential DNS manipulation and service disruption.

Red Hat has released an updated version of unbound that includes a new configuration file '/etc/unbound/conf.d/remote-control.conf' which restricts control interface access to a Unix socket and enables certificate-based authentication. Users should update to this patched version. To verify vulnerability status, run 'unbound-control status | grep control'; output containing 'control(ssl)' or 'control(namedpipe)' indicates a non-vulnerable configuration. If vulnerable, add 'include: /etc/unbound/conf.d/remote-control.conf' to the end of '/etc/unbound/unbound.conf' or update custom remote-control.conf files with the new directives. Applying the update and configuration changes addresses the vulnerability.