CVE-2020-25687
published 2021-01-20CVE-2020-25687: A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the…
PriorityP351medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
86.69%
99.7th percentile
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | dnsmasq | < dnsmasq 2.83-1 (bookworm) | dnsmasq 2.83-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cm1_dnsmasq_2.85-1_on_cbl_mariner_1.0 | — | — |
| thekelleys | dnsmasq | < 2.83 | 2.83 |
| thekelleys | dnsmasq | — | — |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.83-1 | 2.83-1 |
| thekelleys | dnsmasq | >= 0 < 2.75-1ubuntu0.16.04.7 | 2.75-1ubuntu0.16.04.7 |
| thekelleys | dnsmasq | >= 0 < 2.75-1ubuntu0.16.04.8 | 2.75-1ubuntu0.16.04.8 |
| thekelleys | dnsmasq | >= 0 < 2.79-1ubuntu0.2 | 2.79-1ubuntu0.2 |
| thekelleys | dnsmasq | >= 0 < 2.79-1ubuntu0.3 | 2.79-1ubuntu0.3 |
| thekelleys | dnsmasq | >= 0 < 2.80-1.1ubuntu1.2 | 2.80-1.1ubuntu1.2 |
| thekelleys | dnsmasq | >= 0 < 2.80-1.1ubuntu1.3 | 2.80-1.1ubuntu1.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is only triggerable when dnsmasq is compiled with HAVE_DNSSEC flag AND DNSSEC is enabled at runtime (e.g. via --dnssec option). Scope detection to DNSSEC-enabled dnsmasq instances only. ↗
- →The exploit path requires an attacker to supply crafted DNS replies — monitor for unexpected or anomalous DNS responses reaching dnsmasq, particularly from upstream resolvers or via packet injection (ID/port guessing). ↗
- →The vulnerable code path is in rfc1035.c:extract_name() leading to sort_rrset(); a dnsmasq crash (DoS) is the observable outcome — alert on unexpected dnsmasq process termination when DNSSEC is enabled. ↗
- →If dnsmasq is configured as an Open Resolver (accepting queries from the whole Internet), exploitation requires no user interaction and can be performed at will — prioritise patching or DNSSEC disablement on open-resolver deployments. ↗
- →This vulnerability is part of the DNSpooq disclosure set (January 19, 2021); correlate with other DNSpooq CVEs when triaging affected Cisco and other vendor products. ↗
- ·Versions of dnsmasq shipped with Red Hat Enterprise Linux 5, 6, and 7 are NOT affected because they are not compiled with DNSSEC support. ↗
- ·Fixed in dnsmasq 2.83; Debian packages fixed in 2.83-1 across bookworm, bullseye, forky, sid, and trixie. ↗
- ·The only known mitigation (short of patching) is to disable DNSSEC entirely by removing the --dnssec command line option or the dnssec option from the dnsmasq configuration file. ↗
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv5.9MEDIUM
vendor_cisco8.1HIGH
vendor_debian5.9MEDIUM
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rv27-69cw-6j7x: A flaw was found in dnsmasq before version 2
ghsa_unreviewed·2022-05-24
CVE-2020-25687 [HIGH] CWE-122 GHSA-rv27-69cw-6j7x: A flaw was found in dnsmasq before version 2
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
OSV
dnsmasq regression
osv·2021-02-24·CVSS 3.7
[LOW] dnsmasq regression
dnsmasq regression
USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced
regressions in certain environments related to issues with multiple
queries, and issues with retries. This update fixes the problem.
Original advisory details:
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol an
OSV
CVE-2020-25687: A flaw was found in dnsmasq before version 2
osv·2021-01-20·CVSS 5.9
CVE-2020-25687 [MEDIUM] CVE-2020-25687: A flaw was found in dnsmasq before version 2
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
OSV
dnsmasq vulnerabilities
osv·2021-01-19·CVSS 3.7
CVE-2020-25681 [LOW] dnsmasq vulnerabilities
dnsmasq vulnerabilities
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented address/port checks. A remote attacker could use this issue to
perform a cache poisoning attack. (CVE-2020-25684)
Moshe Kol and Shlomi Oberman discovered that
CISA ICS
dnsmasq by Simon Kelley (Update A)
cisa_ics·2021-03-09·CVSS 8.1
[HIGH] dnsmasq by Simon Kelley (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
dnsmasq by Simon Kelley (Update A)
Last RevisedMarch 09, 2021
Alert CodeICSA-21-019-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: dnsmasq by Simon Kelley
- Equipment: dnsmasq
- Vulnerabilities: Heap-based Buffer Overflow, Insufficient Verification of Data Authenticity, Use of a Broken or Risky Cryptographic Algorithm
CISA is aware of a public report, known as “DNSpooq” that details vulnerabilities found in dnsmasq, a prevalent lightweight DNS and DHCP server developed and maintained by Simon Kelley. CISA is i
Ubuntu
Dnsmasq regression
vendor_ubuntu·2021-02-24·CVSS 3.7
[LOW] Dnsmasq regression
Title: Dnsmasq regression
Summary: USN-4698-1 introduced regressions in Dnsmasq.
USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced
regressions in certain environments related to issues with multiple
queries, and issues with retries. This update fixes the problem.
Original advisory details:
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
Cisco
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
vendor_cisco·2021-01-19·CVSS 8.1
CVE-2020-25681 [HIGH] CWE-340 Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
A set of previously unknown vulnerabilities in the DNS forwarder implementation of dnsmasq were disclosed on January 19, 2021. The vulnerabilities are collectively known as DNSpooq.
Exploitation of these vulnerabilities could result in remote code execution or denial of service (DoS), or may allow an attacker to more easily forge DNS answers that can poison DNS caches, depending on the specific vulnerability.
Multiple Cisco products are affected by these vulnerabilities.
Cisco will release software updates that address these vulnerabilities. Any workarounds for a specific Cisco product or service will be documented in the relevant Cisco bugs, which are identified in the Vulnerable Products section of
Red Hat
dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled
vendor_redhat·2021-01-19·CVSS 5.9
CVE-2020-25687 [MEDIUM] CWE-122 dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled
dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabl
Ubuntu
Dnsmasq vulnerabilities
vendor_ubuntu·2021-01-19·CVSS 3.7
CVE-2020-25684 [LOW] Dnsmasq vulnerabilities
Title: Dnsmasq vulnerabilities
Summary: Several security issues were fixed in Dnsmasq.
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented address/port checks. A remote attacker could use this issue to
perform a cache poisoning attack.
Microsoft
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remo
vendor_msrc·2021-01-12·CVSS 5.9
CVE-2020-25687 [MEDIUM] CWE-122 A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remo
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker who can create valid DNS replies to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name() which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq resulting in a denial of service. The highest threat from this vulnerability is to system availability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to
Debian
CVE-2020-25687: dnsmasq - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow wa...
vendor_debian·2020·CVSS 5.9
CVE-2020-25687 [MEDIUM] CVE-2020-25687: dnsmasq - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow wa...
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Scope: local
bookworm: resolved (fixed in 2.83-1)
bullseye: resolved (fixed in 2.83-1)
forky: resolved (fixed in 2.83-1)
sid: resolved (fixed in 2.83-1)
trixie: resolved (fixed in 2.83-1)
Cisco
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
vendor_cisco·CVSS 3.1
CVE-2020-25687 Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
CVE-2020-25687: Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021
A set of previously unknown vulnerabilities in the DNS forwarder implementation of dnsmasq were disclosed on January 19, 2021. The vulnerabilities are collectively known as DNSpooq . Exploitation of these vulnerabilities could result in remote code execution or denial of service (DoS), or may allow an attacker to more easily forge DNS answers that can poison DNS caches, depending on the specific vulnerability. Multiple Cisco products are affected by these vulnerabilities. Cisco will release software updates that address these vulnerabilities. Any
CVSS: 3.1
CWE: CWE-340, CWE-340
Bug IDs: CSCvv83232, CSCvw00918, CSCvx17339, CSCvv83232, CSCvw00918
No detection rules found.
No public exploits indexed.
Unit42
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
blogs_unit42·2021-03-08
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
## Executive Summary
DNS masquerade (dnsmasq) is a widely used open source DNS resolver. While one might not be familiar with dnsmasq by name, it is used by many projects and hardware firmwares around the world, from Kubernetes to routers and other products.
Over the years, multiple critical vulnerabilities have been found in dnsmasq. Recently, security researchers discovered new issues that continue to make dnsmasq vulnerable. These vulnerabilities can lead to DNS cache poisoning, denial of service (DoS) and possibly remote code execution (RCE). In this blog, I will review these vulnerabilities in dnsmasq, with a deep dive on DNS cache poisoning. I will also cover the effect such issues have on cloud products such as Kubernetes.
Palo Alto Networks customers are protected from the attac
Unit42
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
blogs_unit42·2021-03-08
Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
Threat Research Center
Threat Research
DNS
## Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
Daniel Prizmant
Published: March 8, 2021
DNS
Threat Research
Vulnerabilities
CoreDNS
Dnsmasq
History
Kube-dns
## Executive Summary
DNS masquerade (dnsmasq) is a widely used open source DNS resolver. While one might not be familiar with dnsmasq by name, it is used by many projects and hardware firmwares around the world , from Kubernetes to routers and other products.
Over the years, multiple critical vulnerabilities have been found in dnsmasq. Recently, security researchers discovered new issues that continue to make dnsmasq vulnerable. These vulnerabilities can lead to DNS cache poisoning, denial of service (DoS) and possibly remote code execution (RCE).
Tenable
DNSpooq: Seven Vulnerabilities Identified in dnsmasq
blogs_tenable·2021-01-20
DNSpooq: Seven Vulnerabilities Identified in dnsmasq
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2020-25687 dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled
bugzilla·2020-10-26·CVSS 5.9
CVE-2020-25687 [MEDIUM] CVE-2020-25687 dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled
CVE-2020-25687 dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled
An heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with negative size in sort_rrset(), which is interpreted as huge numbers.
Discussion:
To trigger the flaw, dnsmasq has to be compiled with HAVE_DNSSEC flag and DNSSEC has to be enabled (e.g. with --dnssec option). Moreover, the attacker shall either control a DNS server used in the domain name resolutio
https://bugzilla.redhat.com/show_bug.cgi?id=1891568https://lists.debian.org/debian-lts-announce/2021/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/https://security.gentoo.org/glsa/202101-17https://www.debian.org/security/2021/dsa-4844https://www.jsof-tech.com/disclosures/dnspooq/https://bugzilla.redhat.com/show_bug.cgi?id=1891568https://lists.debian.org/debian-lts-announce/2021/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/https://security.gentoo.org/glsa/202101-17https://www.debian.org/security/2021/dsa-4844https://www.jsof-tech.com/disclosures/dnspooq/https://www.kb.cert.org/vuls/id/434904
2021-01-20
Published