Heap-based buffer overflow in Dnsmasq - CVE-2020-25687

Vulnerability identifier: #VU49846

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25687

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in rfc1035.c:extract_name(). A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and cause a denial of service condition on the target system.

Dnsmasq
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Slackware Linux
Ubuntu
openEuler
Fedora
AWK-1137C Series
AWK-4131A
AWK-1131A Series
AWK-3131A Series
dnsmasq (Debian package)
dnsmasq (Alpine package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
dnsmasq-utils (Ubuntu package)
dnsmasq-base (Ubuntu package)
dnsmasq (Ubuntu package)
dnsmasq (Red Hat package)
dnsmasq
dnsmasq-debuginfo
dnsmasq-debugsource
dnsmasq-help

Install updates from vendor's website.

Dnsmasq - update to 2.83
AWK-1137C Series - update to 1.7
AWK-3131A Series - update to 1.17
AWK-4131A - update to 1.17
AWK-1131A Series - update to 1.23
dnsmasq (Debian package) - update to 2.80-1+deb10u1
dnsmasq (Alpine package) - update to 2.83-r0
dnsmasq-utils (Ubuntu package) - addressed in versions 2.75-1ubuntu0.16.04.7, 2.75-1ubuntu0.16.04.8, 2.79-1ubuntu0.2, 2.79-1ubuntu0.3, 2.80-1.1ubuntu1.2, 2.80-1.1ubuntu1.3, 2.82-1ubuntu1.1, 2.82-1ubuntu1.2
dnsmasq-base (Ubuntu package) - addressed in versions 2.75-1ubuntu0.16.04.7, 2.75-1ubuntu0.16.04.8, 2.79-1ubuntu0.2, 2.79-1ubuntu0.3, 2.80-1.1ubuntu1.2, 2.80-1.1ubuntu1.3, 2.82-1ubuntu1.1, 2.82-1ubuntu1.2
dnsmasq (Ubuntu package) - addressed in versions 2.75-1ubuntu0.16.04.7, 2.75-1ubuntu0.16.04.8, 2.79-1ubuntu0.2, 2.79-1ubuntu0.3, 2.80-1.1ubuntu1.2, 2.80-1.1ubuntu1.3, 2.82-1ubuntu1.1, 2.82-1ubuntu1.2
dnsmasq (Red Hat package) - addressed in versions 2.79-6.el8_1.1, 2.79-11.el8_2.2, 2.79-13.el8_3.1
dnsmasq - update to 2.82-4
dnsmasq-debuginfo - update to 2.82-4
dnsmasq-debugsource - update to 2.82-4
dnsmasq-help - update to 2.82-4
dnsmasq - addressed in versions 2.83-1.fc33, 2.84-1.fc32

• https://ics-cert.us-cert.gov/advisories/icsa-21-019-01
• https://www.jsof-tech.com/disclosures/dnspooq/

• Multiple vulnerabilities in Dnsmasq
• Heap-based buffer overflow in dnsmasq (Alpine package)
• Red Hat Enterprise Linux 8.2 update for dnsmasq
• Red Hat Enterprise Linux 8.1 update for dnsmasq
• Red Hat Enterprise Linux 8 update for dnsmasq
• Arch Linux update for dnsmasq
• Gentoo update for Dnsmasq
• Debian update for dnsmasq
• Slackware Linux update for dnsmasq
• Moxa AWK-3131A/4131A/1137C/1131A devices update for dnsmasq
• Ubuntu update for dnsmasq
• Ubuntu update for dnsmasq
• openEuler update for dnsmasq
• Fedora 33 update for dnsmasq
• Fedora 32 update for dnsmasq