Memory corruption in Dnsmasq - CVE-2017-13704
Published: October 3, 2017
Vulnerability identifier: #VU8666
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-13704
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to boundary error in when processing DNS queries longer than 512 bytes or EDNS0 packet size is different. A remote unauthenticated attacker can send a specially crafted DNS request to the affected service and trigger the application crash.
Successful exploitation of this vulnerability may allow an attacker to perform a denial of service (DoS) attack.
Affected software
Dnsmasq
SCALANCE W1750D
SCALANCE M800
SCALANCE S615
dnsmasq (Alpine package)
dnsmasq
Slackware Linux
Fedora
Edgeline EL300 Converged Edge System
SCALANCE W1750D
SCALANCE M800
SCALANCE S615
dnsmasq (Alpine package)
dnsmasq
Slackware Linux
Fedora
Edgeline EL300 Converged Edge System
How to mitigate CVE-2017-13704
Update to version 2.78.
dnsmasq (Alpine package) - update to 2.78-r0
Edgeline EL300 Converged Edge System - update to 1.50
dnsmasq - update to 2.77-7.fc27
Edgeline EL300 Converged Edge System - update to 1.50
dnsmasq - update to 2.77-7.fc27