CVE-2020-25682
published 2021-01-20CVE-2020-25682: A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating…
PriorityP268high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
70.75%
99.3th percentile
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | dnsmasq | < dnsmasq 2.83-1 (bookworm) | dnsmasq 2.83-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cm1_dnsmasq_2.85-1_on_cbl_mariner_1.0 | — | — |
| thekelleys | dnsmasq | < 2.83 | 2.83 |
| thekelleys | dnsmasq | — | — |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.75-1ubuntu0.16.04.7 | 2.75-1ubuntu0.16.04.7 |
| thekelleys | dnsmasq | >= 0 < 2.75-1ubuntu0.16.04.8 | 2.75-1ubuntu0.16.04.8 |
| thekelleys | dnsmasq | >= 0 < 2.79-1ubuntu0.2 | 2.79-1ubuntu0.2 |
| thekelleys | dnsmasq | >= 0 < 2.79-1ubuntu0.3 | 2.79-1ubuntu0.3 |
| thekelleys | dnsmasq | >= 0 < 2.80-1.1ubuntu1.2 | 2.80-1.1ubuntu1.2 |
| thekelleys | dnsmasq | >= 0 < 2.80-1.1ubuntu1.3 | 2.80-1.1ubuntu1.3 |
Detection & IOCsextracted from sources · hover to see the quote
urlhttp://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=4e96a4be685c9e4445f6ee79ad0b36b9119b502a↗
- →The vulnerability is only triggerable when dnsmasq is compiled with the HAVE_DNSSEC flag AND DNSSEC is actively enabled at runtime (e.g. via --dnssec option). Systems without DNSSEC support compiled in (RHEL 5/6/7 stock packages) are not affected. ↗
- →The attack vector requires the attacker to be able to create or inject valid DNS replies — either by controlling an upstream DNS server used in resolution, or by injecting packets on the network (e.g. guessing the DNS transaction ID and source port). Monitor for anomalous DNS reply traffic targeting dnsmasq resolvers. ↗
- →If dnsmasq is operating as an Open Resolver (accepting requests from the whole Internet), exploitation requires no user interaction. Audit dnsmasq deployments for open-resolver configuration as a high-risk indicator. ↗
- →This CVE is part of the 'DNSpooq' vulnerability cluster disclosed January 19, 2021. Detections or threat intel referencing DNSpooq should be correlated with this CVE. ↗
- →Cisco Bug IDs CSCvv83232, CSCvw00918, and CSCvx17339 track affected Cisco products. Use these IDs to identify vulnerable Cisco devices in the environment. ↗
- ·Vulnerability only manifests when dnsmasq is compiled with DNSSEC support (HAVE_DNSSEC) AND DNSSEC is enabled at runtime. RHEL 5, 6, and 7 stock dnsmasq packages are NOT affected because they are not compiled with DNSSEC support. ↗
- ·The only known mitigation (short of patching to dnsmasq 2.83+) is to disable DNSSEC by removing the --dnssec command line option or the dnssec option from the dnsmasq configuration file. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.3HIGHAV:N/AC:M/Au:N/C:P/I:P/A:C
osv8.1HIGH
vendor_cisco8.1HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_redhat8.1HIGH
vendor_ubuntu3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
dnsmasq by Simon Kelley (Update A)
cisa_ics·2021-03-09·CVSS 8.1
[HIGH] dnsmasq by Simon Kelley (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
dnsmasq by Simon Kelley (Update A)
Last RevisedMarch 09, 2021
Alert CodeICSA-21-019-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: dnsmasq by Simon Kelley
- Equipment: dnsmasq
- Vulnerabilities: Heap-based Buffer Overflow, Insufficient Verification of Data Authenticity, Use of a Broken or Risky Cryptographic Algorithm
CISA is aware of a public report, known as “DNSpooq” that details vulnerabilities found in dnsmasq, a prevalent lightweight DNS and DHCP server developed and maintained by Simon Kelley. CISA is i
Ubuntu
Dnsmasq regression
vendor_ubuntu·2021-02-24·CVSS 3.7
[LOW] Dnsmasq regression
Title: Dnsmasq regression
Summary: USN-4698-1 introduced regressions in Dnsmasq.
USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced
regressions in certain environments related to issues with multiple
queries, and issues with retries. This update fixes the problem.
Original advisory details:
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
Cisco
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
vendor_cisco·2021-01-19·CVSS 8.1
CVE-2020-25681 [HIGH] CWE-340 Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
A set of previously unknown vulnerabilities in the DNS forwarder implementation of dnsmasq were disclosed on January 19, 2021. The vulnerabilities are collectively known as DNSpooq.
Exploitation of these vulnerabilities could result in remote code execution or denial of service (DoS), or may allow an attacker to more easily forge DNS answers that can poison DNS caches, depending on the specific vulnerability.
Multiple Cisco products are affected by these vulnerabilities.
Cisco will release software updates that address these vulnerabilities. Any workarounds for a specific Cisco product or service will be documented in the relevant Cisco bugs, which are identified in the Vulnerable Products section of
Red Hat
dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled
vendor_redhat·2021-01-19·CVSS 8.1
CVE-2020-25682 [HIGH] CWE-122 dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled
dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that ca
Ubuntu
Dnsmasq vulnerabilities
vendor_ubuntu·2021-01-19·CVSS 3.7
CVE-2020-25684 [LOW] Dnsmasq vulnerabilities
Title: Dnsmasq vulnerabilities
Summary: Several security issues were fixed in Dnsmasq.
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented address/port checks. A remote attacker could use this issue to
perform a cache poisoning attack.
Microsoft
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the ne
vendor_msrc·2021-01-12·CVSS 8.1
CVE-2020-25682 [HIGH] CWE-122 A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the ne
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network who can create valid DNS replies could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However in some code execution paths it is possible extract_name() gets passed an offset from the base buffer thus reducing in practice the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and in
Debian
CVE-2020-25682: dnsmasq - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was dis...
vendor_debian·2020·CVSS 8.1
CVE-2020-25682 [HIGH] CVE-2020-25682: dnsmasq - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was dis...
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiali
Cisco
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
vendor_cisco·CVSS 3.1
CVE-2020-25682 Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
CVE-2020-25682: Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
A set of previously unknown vulnerabilities in the DNS forwarder implementation of dnsmasq were disclosed on January 19, 2021. The vulnerabilities are collectively known as DNSpooq . Exploitation of these vulnerabilities could result in remote code execution or denial of service (DoS), or may allow an attacker to more easily forge DNS answers that can poison DNS caches, depending on the specific vulnerability. Multiple Cisco products are affected by these vulnerabilities. Cisco will release software updates that address these vulnerabilities. Any
CVSS: 3.1
CWE: CWE-340, CWE-340
Bug IDs: CSCvv83232, CSCvw00918, CSCvx17339, CSCvv83232, CSCvw00918
GHSA
GHSA-3qqq-357h-32gj: A flaw was found in dnsmasq before 2
ghsa_unreviewed·2022-05-24
CVE-2020-25682 [HIGH] CWE-122 GHSA-3qqq-357h-32gj: A flaw was found in dnsmasq before 2
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiali
OSV
dnsmasq regression
osv·2021-02-24·CVSS 3.7
[LOW] dnsmasq regression
dnsmasq regression
USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced
regressions in certain environments related to issues with multiple
queries, and issues with retries. This update fixes the problem.
Original advisory details:
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol an
OSV
CVE-2020-25682: A flaw was found in dnsmasq before 2
osv·2021-01-20·CVSS 8.1
CVE-2020-25682 [HIGH] CVE-2020-25682: A flaw was found in dnsmasq before 2
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiali
OSV
dnsmasq vulnerabilities
osv·2021-01-19·CVSS 3.7
CVE-2020-25681 [LOW] dnsmasq vulnerabilities
dnsmasq vulnerabilities
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented address/port checks. A remote attacker could use this issue to
perform a cache poisoning attack. (CVE-2020-25684)
Moshe Kol and Shlomi Oberman discovered that
No detection rules found.
No public exploits indexed.
Unit42
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
blogs_unit42·2021-03-08
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
## Executive Summary
DNS masquerade (dnsmasq) is a widely used open source DNS resolver. While one might not be familiar with dnsmasq by name, it is used by many projects and hardware firmwares around the world, from Kubernetes to routers and other products.
Over the years, multiple critical vulnerabilities have been found in dnsmasq. Recently, security researchers discovered new issues that continue to make dnsmasq vulnerable. These vulnerabilities can lead to DNS cache poisoning, denial of service (DoS) and possibly remote code execution (RCE). In this blog, I will review these vulnerabilities in dnsmasq, with a deep dive on DNS cache poisoning. I will also cover the effect such issues have on cloud products such as Kubernetes.
Palo Alto Networks customers are protected from the attac
Unit42
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
blogs_unit42·2021-03-08
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
Threat Research Center
Threat Research
DNS
## Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
Daniel Prizmant
Published: March 8, 2021
DNS
Threat Research
Vulnerabilities
CoreDNS
Dnsmasq
History
Kube-dns
## Executive Summary
DNS masquerade (dnsmasq) is a widely used open source DNS resolver. While one might not be familiar with dnsmasq by name, it is used by many projects and hardware firmwares around the world , from Kubernetes to routers and other products.
Over the years, multiple critical vulnerabilities have been found in dnsmasq. Recently, security researchers discovered new issues that continue to make dnsmasq vulnerable. These vulnerabilities can lead to DNS cache poisoning, denial of service (DoS) and possibly remote code execution (RCE).
Tenable
DNSpooq: Seven Vulnerabilities Identified in dnsmasq
blogs_tenable·2021-01-20
DNSpooq: Seven Vulnerabilities Identified in dnsmasq
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2020-25682 dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled
bugzilla·2020-09-23·CVSS 8.1
CVE-2020-25682 [HIGH] CVE-2020-25682 dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled
CVE-2020-25682 dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled
A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in rfc1035.c:extract_name() function, which writes data to the memory pointed by `name` assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths it is possible extract_name() gets passed an offset from the base buffer, thus reducing in practice the number of available bytes that can be written in the buffer.
Discussion:
To t
https://bugzilla.redhat.com/show_bug.cgi?id=1882014https://lists.debian.org/debian-lts-announce/2021/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/https://security.gentoo.org/glsa/202101-17https://www.debian.org/security/2021/dsa-4844https://www.jsof-tech.com/disclosures/dnspooq/https://bugzilla.redhat.com/show_bug.cgi?id=1882014https://lists.debian.org/debian-lts-announce/2021/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/https://security.gentoo.org/glsa/202101-17https://www.debian.org/security/2021/dsa-4844https://www.jsof-tech.com/disclosures/dnspooq/https://www.kb.cert.org/vuls/id/434904
2021-01-20
Published