CVE-2015-2809 — Sensitive Information Exposure in Synology Diskstation Manager

CWE-200 — Sensitive Information ExposureCWE-346 — Origin Validation Error5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
1.7%
top 17.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Synology Diskstation Manager
Timeline
PublishedApr 1
Latest updateMay 17

Description

The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets to the Avahi component.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-wgcg-8h66-7wvp: The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3↗2022-05-17
▶
CVEList
CVE-2015-2809: The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3↗2015-04-01
▶

📋Vendor Advisories

2
Microsoft
avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link which allows remote attackers to cause a denial of service (traff↗2017-05-09
▶
Red Hat
avahi: Multicast DNS responds to unicast queries outside of local network↗2015-03-31
▶
CVE-2015-2809 — Sensitive Information Exposure | cvebase