CVE-2020-25681
published 2021-01-20CVE-2020-25681: A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data…
PriorityP269high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
81.19%
99.6th percentile
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | dnsmasq | < dnsmasq 2.83-1 (bookworm) | dnsmasq 2.83-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cm1_dnsmasq_2.85-1_on_cbl_mariner_1.0 | — | — |
| thekelleys | dnsmasq | < 2.83 | 2.83 |
| thekelleys | dnsmasq | — | — |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.75-1ubuntu0.16.04.7 | 2.75-1ubuntu0.16.04.7 |
| thekelleys | dnsmasq | >= 0 < 2.75-1ubuntu0.16.04.8 | 2.75-1ubuntu0.16.04.8 |
| thekelleys | dnsmasq | >= 0 < 2.79-1ubuntu0.2 | 2.79-1ubuntu0.2 |
| thekelleys | dnsmasq | >= 0 < 2.79-1ubuntu0.3 | 2.79-1ubuntu0.3 |
| thekelleys | dnsmasq | >= 0 < 2.80-1.1ubuntu1.2 | 2.80-1.1ubuntu1.2 |
| thekelleys | dnsmasq | >= 0 < 2.80-1.1ubuntu1.3 | 2.80-1.1ubuntu1.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerable function is sort_rrset() in dnssec.c; monitor for heap-based buffer overflows triggered via crafted DNS replies with manipulated RDLENGTH fields in RRSet responses when DNSSEC validation is enabled. ↗
- →The overflow is triggered when RDLENGTH in a DNS reply is attacker-controlled; detect anomalously large or malformed RDLENGTH values in DNS responses directed at dnsmasq instances with DNSSEC enabled. ↗
- →Exploitation requires dnsmasq compiled with HAVE_DNSSEC flag and DNSSEC enabled at runtime; audit deployments for the --dnssec flag or 'dnssec' option in dnsmasq configuration files as a prerequisite indicator. ↗
- →Attack vector includes DNS cache poisoning via guessed transaction ID and source port; monitor for high-rate DNS response injection attempts (ID/port brute-force) targeting dnsmasq resolvers, consistent with the DNSpooq campaign. ↗
- →This vulnerability is part of the 'DNSpooq' disclosure set; correlate detections with other DNSpooq CVEs (CVE-2020-25681 through related IDs) and Cisco Bug IDs CSCvv83232, CSCvw00918, CSCvx17339. ↗
- ·Vulnerability only affects dnsmasq instances compiled with HAVE_DNSSEC and running with DNSSEC enabled; RHEL 5, 6, and 7 ship dnsmasq without DNSSEC support and are not affected. ↗
- ·Fixed in dnsmasq version 2.83; versions prior to 2.83 with DNSSEC enabled are vulnerable. ↗
- ·OpenShift/OSD v4 uses CoreDNS (via the DNS operator) instead of dnsmasq and is not affected; OSD v3 uses dnsmasq on all masters and nodes and may be affected. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.3HIGHAV:N/AC:M/Au:N/C:P/I:P/A:C
osv8.1HIGH
vendor_cisco8.1HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_redhat8.1HIGH
vendor_ubuntu3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
dnsmasq by Simon Kelley (Update A)
cisa_ics·2021-03-09·CVSS 8.1
[HIGH] dnsmasq by Simon Kelley (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
dnsmasq by Simon Kelley (Update A)
Last RevisedMarch 09, 2021
Alert CodeICSA-21-019-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: dnsmasq by Simon Kelley
- Equipment: dnsmasq
- Vulnerabilities: Heap-based Buffer Overflow, Insufficient Verification of Data Authenticity, Use of a Broken or Risky Cryptographic Algorithm
CISA is aware of a public report, known as “DNSpooq” that details vulnerabilities found in dnsmasq, a prevalent lightweight DNS and DHCP server developed and maintained by Simon Kelley. CISA is i
Ubuntu
Dnsmasq regression
vendor_ubuntu·2021-02-24·CVSS 3.7
[LOW] Dnsmasq regression
Title: Dnsmasq regression
Summary: USN-4698-1 introduced regressions in Dnsmasq.
USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced
regressions in certain environments related to issues with multiple
queries, and issues with retries. This update fixes the problem.
Original advisory details:
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
Cisco
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
vendor_cisco·2021-01-19·CVSS 8.1
CVE-2020-25681 [HIGH] CWE-340 Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
A set of previously unknown vulnerabilities in the DNS forwarder implementation of dnsmasq were disclosed on January 19, 2021. The vulnerabilities are collectively known as DNSpooq.
Exploitation of these vulnerabilities could result in remote code execution or denial of service (DoS), or may allow an attacker to more easily forge DNS answers that can poison DNS caches, depending on the specific vulnerability.
Multiple Cisco products are affected by these vulnerabilities.
Cisco will release software updates that address these vulnerabilities. Any workarounds for a specific Cisco product or service will be documented in the relevant Cisco bugs, which are identified in the Vulnerable Products section of
Red Hat
dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled
vendor_redhat·2021-01-19·CVSS 8.1
CVE-2020-25681 [HIGH] CWE-122 dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled
dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepte
Ubuntu
Dnsmasq vulnerabilities
vendor_ubuntu·2021-01-19·CVSS 3.7
CVE-2020-25684 [LOW] Dnsmasq vulnerabilities
Title: Dnsmasq vulnerabilities
Summary: Several security issues were fixed in Dnsmasq.
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented address/port checks. A remote attacker could use this issue to
perform a cache poisoning attack.
Microsoft
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network who can forge D
vendor_msrc·2021-01-12·CVSS 8.1
CVE-2020-25681 [HIGH] CWE-122 A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network who can forge D
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network who can forge DNS replies such as that they are accepted as valid could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most
Debian
CVE-2020-25681: dnsmasq - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow wa...
vendor_debian·2020·CVSS 8.1
CVE-2020-25681 [HIGH] CVE-2020-25681: dnsmasq - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow wa...
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Scope: local
bookworm: resolved (fixed in 2.83-1)
bullseye: resolved (fixed in 2.83-1)
forky: resolved (fixed in 2.83-1)
sid: resolved (fixed in 2.83-1)
trixie: resolved (fixed in 2.83-1)
Cisco
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
vendor_cisco·CVSS 3.1
CVE-2020-25681 Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
CVE-2020-25681: Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
A set of previously unknown vulnerabilities in the DNS forwarder implementation of dnsmasq were disclosed on January 19, 2021. The vulnerabilities are collectively known as DNSpooq . Exploitation of these vulnerabilities could result in remote code execution or denial of service (DoS), or may allow an attacker to more easily forge DNS answers that can poison DNS caches, depending on the specific vulnerability. Multiple Cisco products are affected by these vulnerabilities. Cisco will release software updates that address these vulnerabilities. Any
CVSS: 3.1
CWE: CWE-340, CWE-340
Bug IDs: CSCvv83232, CSCvw00918, CSCvx17339, CSCvv83232, CSCvw00918
GHSA
GHSA-34v3-rp23-947c: A flaw was found in dnsmasq before version 2
ghsa_unreviewed·2022-05-24
CVE-2020-25681 [HIGH] CWE-122 GHSA-34v3-rp23-947c: A flaw was found in dnsmasq before version 2
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
OSV
dnsmasq regression
osv·2021-02-24·CVSS 3.7
[LOW] dnsmasq regression
dnsmasq regression
USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced
regressions in certain environments related to issues with multiple
queries, and issues with retries. This update fixes the problem.
Original advisory details:
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol an
OSV
CVE-2020-25681: A flaw was found in dnsmasq before version 2
osv·2021-01-20·CVSS 8.1
CVE-2020-25681 [HIGH] CVE-2020-25681: A flaw was found in dnsmasq before version 2
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
OSV
dnsmasq vulnerabilities
osv·2021-01-19·CVSS 3.7
CVE-2020-25681 [LOW] dnsmasq vulnerabilities
dnsmasq vulnerabilities
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented address/port checks. A remote attacker could use this issue to
perform a cache poisoning attack. (CVE-2020-25684)
Moshe Kol and Shlomi Oberman discovered that
No detection rules found.
No public exploits indexed.
Unit42
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
blogs_unit42·2021-03-08
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
## Executive Summary
DNS masquerade (dnsmasq) is a widely used open source DNS resolver. While one might not be familiar with dnsmasq by name, it is used by many projects and hardware firmwares around the world, from Kubernetes to routers and other products.
Over the years, multiple critical vulnerabilities have been found in dnsmasq. Recently, security researchers discovered new issues that continue to make dnsmasq vulnerable. These vulnerabilities can lead to DNS cache poisoning, denial of service (DoS) and possibly remote code execution (RCE). In this blog, I will review these vulnerabilities in dnsmasq, with a deep dive on DNS cache poisoning. I will also cover the effect such issues have on cloud products such as Kubernetes.
Palo Alto Networks customers are protected from the attac
Unit42
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
blogs_unit42·2021-03-08
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
Threat Research Center
Threat Research
DNS
## Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
Daniel Prizmant
Published: March 8, 2021
DNS
Threat Research
Vulnerabilities
CoreDNS
Dnsmasq
History
Kube-dns
## Executive Summary
DNS masquerade (dnsmasq) is a widely used open source DNS resolver. While one might not be familiar with dnsmasq by name, it is used by many projects and hardware firmwares around the world , from Kubernetes to routers and other products.
Over the years, multiple critical vulnerabilities have been found in dnsmasq. Recently, security researchers discovered new issues that continue to make dnsmasq vulnerable. These vulnerabilities can lead to DNS cache poisoning, denial of service (DoS) and possibly remote code execution (RCE).
Tenable
DNSpooq: Seven Vulnerabilities Identified in dnsmasq
blogs_tenable·2021-01-20
DNSpooq: Seven Vulnerabilities Identified in dnsmasq
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2020-25681 dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled
bugzilla·2020-09-23·CVSS 8.1
CVE-2020-25681 [HIGH] CVE-2020-25681 dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled
CVE-2020-25681 dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled
An heap-based buffer overflow was discovered in dnsmasq in the way it sorts RRSets before validating them with DNSSEC data. An attacker, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine.
Discussion:
To trigger the flaw, dnsmasq has to be compiled with HAVE_DNSSEC flag and DNSSEC has to be enabled (e.g. with --dnssec option). Moreover, the attacker shall either control a DNS server used in the domain name resolution process or be able to inject packets on the network in such a way to trick dnsmasq into accepting them (e.g. guessing the ID, random port used
https://bugzilla.redhat.com/show_bug.cgi?id=1881875https://lists.debian.org/debian-lts-announce/2021/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/https://security.gentoo.org/glsa/202101-17https://www.debian.org/security/2021/dsa-4844https://www.jsof-tech.com/disclosures/dnspooq/https://bugzilla.redhat.com/show_bug.cgi?id=1881875https://lists.debian.org/debian-lts-announce/2021/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/https://security.gentoo.org/glsa/202101-17https://www.debian.org/security/2021/dsa-4844https://www.jsof-tech.com/disclosures/dnspooq/https://www.kb.cert.org/vuls/id/434904
2021-01-20
Published