CVE-2017-13704
published 2017-10-03CVE-2017-13704: In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an…
PriorityP354high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
65.41%
99.2th percentile
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | dnsmasq | < dnsmasq 2.78-1 (bookworm) | dnsmasq 2.78-1 (bookworm) |
| fedoraproject | fedora | — | — |
| novell | leap | — | — |
| novell | leap | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| thekelleys | dnsmasq | <= 2.77 | — |
| thekelleys | dnsmasq | >= 0 < 2.78-1 | 2.78-1 |
| thekelleys | dnsmasq | >= 0 < 2.78-1 | 2.78-1 |
| thekelleys | dnsmasq | >= 0 < 2.78-1 | 2.78-1 |
| thekelleys | dnsmasq | >= 0 < 2.78-1 | 2.78-1 |
Detection & IOCsextracted from sources · hover to see the quote
urlhttp://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=63437ffbb58837b214b4b92cb1c54bc5f3279928↗
- →Detect oversized DNS query packets: trigger condition is a DNS query where the request length (qlen) is larger than 512 bytes, or includes an EDNS0 packet size field, AND the request is larger than what the EDNS0 size field specifies — this causes a negative memset size parameter and crashes dnsmasq. ↗
- →Monitor for unexpected dnsmasq process crashes (denial-of-service), especially following receipt of crafted DNS request messages on UDP port 53, as a sign of exploitation attempts. ↗
- →Flag DNS packets where the declared EDNS0 payload size is smaller than the actual received packet length — this mismatch is the precise trigger for the integer underflow in vulnerable dnsmasq versions (< 2.78). ↗
- ·Vulnerability is a regression introduced in dnsmasq 2.77 only; versions prior to 2.77 are NOT affected. Only dnsmasq 2.77 is vulnerable; fixed in 2.78. ↗
- ·Red Hat Enterprise Linux 5, 6, and 7 ship a dnsmasq version that is NOT affected by this CVE — do not prioritize patching on those platforms. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SCALANCE W1750D, M800, S615, and RUGGEDCOM RM1224 (Update C)
cisa_ics·2018-05-10·CVSS 7.5
[HIGH] Siemens SCALANCE W1750D, M800, S615, and RUGGEDCOM RM1224 (Update C)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE W1750D, M800, S615, and RUGGEDCOM RM1224 (Update C)
Last RevisedOctober 13, 2020
Alert CodeICSA-17-332-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely/low skill level to exploit.
- Vendor: Siemens
--------- Begin Update C Part 1 of 3 --------
- Equipment: SCALANCE W1750D, M800, S615, and RUGGEDCOM RM1224
--------- End Update C Part 1 of 3 --------
- Vulnerabilities: Resource Exhaustion, Improper Restriction of Operations within the Bounds of a Memory Buffer
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the up
Red Hat
dnsmasq: Size parameter overflow via large DNS query
vendor_redhat·2017-08-21·CVSS 7.5
CVE-2017-13704 [HIGH] CWE-190 dnsmasq: Size parameter overflow via large DNS query
dnsmasq: Size parameter overflow via large DNS query
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the DNS code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash.
Package: dnsmasq (Red Hat Enterprise Linux 5) - Not affected
Package: dnsmasq (Red Hat Enterprise Linux 6) - Not affected
Package: dnsmasq (Red Hat Enterprise Linux 7) - Not affected
Package: dnsmasq (Red Hat Enterprise Linux OpenStack Platform 6 (Juno)) - Not affected
Package: dns
Debian
CVE-2017-13704: dnsmasq - In dnsmasq before 2.78, if the DNS packet size does not match the expected size,...
vendor_debian·2017·CVSS 7.5
CVE-2017-13704 [HIGH] CVE-2017-13704: dnsmasq - In dnsmasq before 2.78, if the DNS packet size does not match the expected size,...
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
Scope: local
bookworm: resolved (fixed in 2.78-1)
bullseye: resolved (fixed in 2.78-1)
forky: resolved (fixed in 2.78-1)
sid: resolved (fixed in 2.78-1)
trixie: resolved (fixed in 2.78-1)
GHSA
GHSA-mprq-hpvv-8wcc: In dnsmasq before 2
ghsa_unreviewed·2022-05-14
CVE-2017-13704 [HIGH] CWE-20 GHSA-mprq-hpvv-8wcc: In dnsmasq before 2
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
OSV
CVE-2017-13704: In dnsmasq before 2
osv·2017-10-03·CVSS 7.5
CVE-2017-13704 [HIGH] CVE-2017-13704: In dnsmasq before 2
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
No detection rules found.
No public exploits indexed.
Trendmicro
Dnsmasq: A Reality Check and Remediation Practices
blogs_trendmicro·2017-10-09
Dnsmasq: A Reality Check and Remediation Practices
IoT
# Dnsmasq: A Reality Check and Remediation Practices
Google Security researchers identified seven vulnerabilities that can allow a remote attacker to execute code on, leak information from, or crash a device running a Dnsmasq version earlier than 2.78, if configured with certain options.
By: Federico Maggi
2017/10/09
Read time: ( words)
Save to Folio
Updated on October 10, 2017, 7:30 PM PDT to add further Trend Micro solutions.
Dnsmasq is the de-facto tool for meeting the DNS/DHCP requirements of small servers and embedded devices. Recently, Google Security researchers identified seven vulnerabilities that can allow a remote attacker to execute code on, leak information from, or crash a device running a Dnsmasq version earlier than 2.78, if configured with certain options.
Base
Bugzilla
CVE-2017-13704 dnsmasq: Size parameter overflow via large DNS query
bugzilla·2017-09-26·CVSS 7.5
CVE-2017-13704 [HIGH] CVE-2017-13704 dnsmasq: Size parameter overflow via large DNS query
CVE-2017-13704 dnsmasq: Size parameter overflow via large DNS query
It was found that if a DNS query request (qlen) is either larger than 512, or includes an EDNS0 packet size field, and the request is larger than what it specifies, then the size parameter to memset will overflow and become negative. An attacker could use this for a remote denial of service attack.
References:
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2017q3/011729.html
Upstream patch:
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=63437ffbb58837b214b4b92cb1c54bc5f3279928
Discussion:
Upstream CHANGELOG notes this issue is a regression introduced in dnsmasq version 2.77 and is getting fixed in version 2.78.
http://thekelleys.org.uk/dnsmasq/CHANGELOGhttp://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=63437ffbb58837b214b4b92cb1c54bc5f3279928http://www.securityfocus.com/bid/101085http://www.securityfocus.com/bid/101977http://www.securitytracker.com/id/1039474https://access.redhat.com/security/vulnerabilities/3199382https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdfhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TK6DWC53WSU6633EVZL7H4PCWBYHMHK/https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.htmlhttps://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.htmlhttps://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.htmlhttps://www.synology.com/support/security/Synology_SA_17_59_Dnsmasqhttp://thekelleys.org.uk/dnsmasq/CHANGELOGhttp://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=63437ffbb58837b214b4b92cb1c54bc5f3279928http://www.securityfocus.com/bid/101085http://www.securityfocus.com/bid/101977http://www.securitytracker.com/id/1039474https://access.redhat.com/security/vulnerabilities/3199382https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdfhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TK6DWC53WSU6633EVZL7H4PCWBYHMHK/https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.htmlhttps://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.htmlhttps://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.htmlhttps://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq
2017-10-03
Published