DATABASE RESOURCES PRICING ABOUT US

{"id": "VU:434904", "vendorId": null, "type": "cert", "bulletinFamily": "info", "title": "Dnsmasq is vulnerable to memory corruption and cache poisoning", "description": "### Overview\n\nDnsmasq is vulnerable to a set of memory corruption issues handling DNSSEC data and a second set of issues validating DNS responses. These vulnerabilities could allow an attacker to corrupt memory on a vulnerable system and perform cache poisoning attacks against a vulnerable environment.\n\nThese vulnerabilities are also tracked as [ICS-VU-668462](<https://us-cert.cisa.gov/ics/advisories/icsa-21-019-01>) and referred to as [DNSpooq](<https://www.jsof-tech.com/disclosures/dnspooq>).\n\n### Description\n\n[Dnsmasq](<http://www.thekelleys.org.uk/dnsmasq/doc.html>) is widely used open-source software that provides DNS forwarding and caching (and also a DHCP server). Dnsmasq is common in Internet-of-Things (IoT) and other embedded devices.\n\nJSOF reported multiple memory corruption vulnerabilities in dnsmasq due to boundary checking errors in DNSSEC handling code.\n\n * CVE-2020-25681: A heap-based buffer overflow in dnsmasq in the way it sorts RRSets before validating them with DNSSEC data in an unsolicited DNS response\n * CVE-2020-25682: A buffer overflow vulnerability in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data\n * CVE-2020-25683: A heap-based buffer overflow in get_rdata subroutine of dnsmasq, when DNSSEC is enabled and before it validates the received DNS entries\n * CVE-2020-25687: A heap-based buffer overflow in sort_rrset subroutine of dnsmasq, when DNSSEC is enabled and before it validates the received DNS entries\n\nJSOF also reported vulnerabilities in DNS response validation that can result in DNS cache poisoning.\n\n * CVE-2020-25684: Dnsmasq does not validate the combination of address/port and the query-id fields of DNS request when accepting DNS responses\n * CVE-2020-25685: Dnsmasq uses a weak hashing algorithm (CRC32) when compiled without DNSSEC to validate DNS responses\n * CVE-2020-25686: Dnsmasq does not check for an existing pending request for the same name and forwards a new request thus allowing an attacker to perform a [\"Birthday Attack\"](<https://tools.ietf.org/html/rfc5452#section-5>) scenario to forge replies and potentially poison the DNS cache\n\nNote: These cache poisoning scenarios and defenses are discussed in [IETF RFC5452](<https://tools.ietf.org/html/rfc5452>).\n\n### Impact\n\nThe memory corruption vulnerabilities can be triggered by a remote attacker using crafted DNS responses that can lead to denial of service, information exposure, and potentially remote code execution. The DNS response validation vulnerabilities allow an attacker to use unsolicited DNS responses to poison the DNS cache and redirect users to arbitrary sites.\n\n### Solution\n\n#### Apply updates\n\nThese vulnerabilities are addressed in [dnsmasq 2.83](<http://www.thekelleys.org.uk/dnsmasq/?C=M;O=D>). Users of IoT and embedded devices that use dnsmasq should contact their vendors.\n\n#### Follow security best-practices\n\nConsider the following security best-practices to protect DNS infrastructure:\n\n * Protect your DNS clients using [stateful-inspection firewall](<https://www.govinfo.gov/content/pkg/GOVPUB-C13-f52fdee3827e2f5d903fa8b4b66d4855/pdf/GOVPUB-C13-f52fdee3827e2f5d903fa8b4b66d4855.pdf>) that provide DNS security (e.g., stateful firewalls and NAT devices can block unsolicited DNS responses, DNS application layer inspection can prevent forwarding of anomalous DNS packets).\n * Provide secure DNS recursion service with features such as DNSSEC validation and the interim [0x20-bit encoding](<https://astrolavos.gatech.edu/articles/increased_dns_resistance.pdf>) as part of enterprise DNS services where applicable. \n * Prevent exposure of IoT devices and lightweight devices directly over the Internet to minimize abuse of DNS.\n * Implement a [Secure By Default](<https://en.wikipedia.org/wiki/Secure_by_default>) configuration suitable for your operating environment (e.g., disable caching on embedded IoT devices when an upstream caching resolver is available).\n\n### Acknowledgements\n\nMoshe Kol and Shlomi Oberman of [JSOF](<https://jsof-tech.com>) researched and reported these vulnerabilities. Simon Kelley (author of dnsmasq) worked closely with collaborative vendors (Cisco, Google, Pi-Hole, Redhat) to develop patches to address these security vulnerabilities. GitHub also supported these collaboration efforts providing support to use their [GitHub Security Advisory](<https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/about-github-security-advisories>) platform for collaboration.\n\nThis document was written by Vijay Sarvepalli.\n\n### Vendor Information\n\n434904\n\nFilter by status: All Affected Not Affected Unknown\n\nFilter by content: __ Additional information available\n\n__ Sort by: Status Alphabetical\n\nExpand all\n\n### Arista Networks Affected\n\nNotified: 2020-09-23 Updated: 2021-01-19\n\n**Statement Date: January 04, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Check Point __ Affected\n\nNotified: 2020-09-24 Updated: 2021-02-08\n\n**Statement Date: February 08, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nCheck Point Gaia is not vulnerable.\n\nCheck Point SMB is vulnerable to CVE-2020-25686, CVE-2020-25684, CVE-2020-25685 on internal (LAN, Wi-Fi) networks. And updated firware is available at https://supportcenter.checkpoint.com/\n\n### Cisco __ Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: January 02, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n#### References\n\n * <https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnsmasq-dns-2021-c5mrdf3g>\n\n### Cradlepoint __ Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: January 19, 2021**\n\n**CVE-2020-25681**| Affected \n---|--- \n**CVE-2020-25682**| Affected \n**CVE-2020-25683**| Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Affected \n \n#### Vendor Statement\n\nCradlepoint devices running NetCloud OS (NCOS) use dnsmasq for domain resolution, domain caching and DHCP services on the local LAN. DNS is a configurable service within NCOS therefore possible configuration states and potential impacts are listed.\n\n**Affected Components:** NCOS versions up to 7.21.20\n\n**Recommendations:** \nPromptly test and upgrade to the latest NCOS version upon release \nDisable (do not enable) DNSSEC until patched \nAuthenticate clients to the LAN using 802.1X \nDo not configure firewall to expose DNS services (UDP port 53) on WAN interfaces\n\n### Default Configuration: DNSSEC disabled\n\n**Cradlepoint Severity:** Low/Medium (dependent upon environment) \n**Potentially Impacted:** Local LAN users, clients and services \n**Potential attack path:** Local LAN \n**Associated CVEs:** CVE-2020-25684, CVE-2020-25685, CVE-2020-25686\n\n### Modified Configuration: DNSSEC enabled\n\n**Cradlepoint Severity:** Medium/High (dependent upon environment) \n**Potentially Impacted:** Device and sub-services; Local LAN users, clients and services \n**Potential attack path:** Local LAN \n**Associated CVEs:** CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687\n\n### Modified Configuration: DNS services exposed on WAN\n\n**Cradlepoint Severity:** Critical (dependent upon environment) \n**Potentially Impacted:** See above \n**Potential attack paths:** WAN interfaces; Local LAN \n**Associated CVEs:** See above\n\n#### References\n\n * <https://cradlepoint.com/about-us/trust/>\n\n### dd-wrt Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: January 11, 2021**\n\n**CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Digi International __ Affected\n\nNotified: 2020-09-24 Updated: 2021-07-20\n\n**Statement Date: July 20, 2021**\n\n**CVE-2020-25681**| Affected \n---|--- \n**CVE-2020-25682**| Affected \n**CVE-2020-25683**| Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Affected \n \n#### Vendor Statement\n\nDigi International has patched this in firmware versions 21.2.X.X on all of our DAL based products, which includes: Digi AnywhereUSB Plus 2 Digi AnywhereUSB Plus 8 Digi AnywhereUSB Plus 8 WiFi Digi AnywhereUSB Plus 24 Digi AnywhereUSB Plus 24 WiFi Digi Connect EZ1 (mini) Digi Connect EZ2 Digi Connect EZ4 Digi ConnectIT4 Digi ConnectIT16 Digi ConnectIT48 Digi ConnectIT-Mini Digi EX15 Digi EX15-PR Digi EX15W Digi EX15W-PR Digi EX12 Digi EX12-PR Digi IX10 Digi IX14 Digi IX15 Digi IX20\n\nDigi IX20-PR Digi IX20W Digi IX20W-PR Digi LR54 Digi LR54W Digi TX54-Dual-Cellular Digi TX54-Dual-Cellular-PR Digi TX54-Dual-Wi-Fi Digi TX54-Single-Cellular Digi TX54-Single-Cellular-PR Digi TX64 Digi TX64-PR Digi TX64-Rail-Single-Cellular-PR Digi VirtualDAL Digi VirtualDAL-PR AcceleratedConcepts 6350-SR AcceleratedConcepts 6355-SR AcceleratedConcepts 6330-MX AcceleratedConcepts 6335-MX AcceleratedConcepts 6310-DX AcceleratedConcepts 5400-RM AcceleratedConcepts 5401-RM AcceleratedConcepts 6300-CX\n\n#### References\n\n * <https://ftp1.digi.com/support/firmware/dal/ConnectIT/ConnectIT_21.2.39.67_93001322.pdf>\n\n### Fujitsu __ Affected\n\nNotified: 2020-12-15 Updated: 2021-06-02\n\n**Statement Date: May 31, 2021**\n\n**CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nFujitsu is aware of the security vulnerabilities in software dnsmasq, also known as \"DNSpooq\". \n\nAffected products are Fujitsu INTELLIEDGE, Fujitsu ServerView Services for ISM, Fujitsu SOA SysRollout Service, Fujitsu SOA Profile Management Service, Fujitsu ISM (Core) and Fujitsu FlexFrame Orchestrator (SAP). Updates are pending or already available.\n\nThe Fujitsu PSIRT has updated the state for Fujitsu PSIRT-IS-2021-011900 on https://security.ts.fujitsu.com (Security Notices) accordingly.\n\nIn case of questions regarding this Fujitsu PSIRT Security Notice, please contact the Fujitsu PSIRT (Fujitsu-PSIRT@ts.fujitsu.com).\n\n### Juniper Networks __ Affected\n\nNotified: 2020-09-25 Updated: 2021-02-08\n\n**Statement Date: February 04, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nThe Juniper SIRT has investigated the impact of these vulnerabilities on Juniper products. Juniper Networks Junos OS, Space, and Contrail products are unaffected by these vulnerabilities.\n\nJuniper Mist Access Points (APs) ship with Dnsmasq and are only affected by the vulnerabilities via DNS (CVE-2020-25684, CVE-2020-25685, CVE-2020-25686) 4.0/CVSS:3.1.\n\nThe Wi-Fi mPIM (Mini-PIM) card for SRX branch devices ship with Dnsmasq enabled by default and is reachable from the network. Only vulnerabilities (CVE-2020-25684, CVE-2020-25685, CVE-2020-25686): 4.0/CVSS:3.1 via DNS affect this card.\n\nCode fixes are underway for Mist and the Mini-PIM card and customers should upgrade when those fixes are available.\n\nSecurity Incident Response Team Juniper Networks\n\n### NetBSD __ Affected\n\nNotified: 2020-09-28 Updated: 2023-06-20\n\n**Statement Date: June 19, 2023**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nNetBSD does not ship dnsmasq and is not affected.\n\npkgsrc users, on any platform, who have elected to install net/dnsmasq may be affected, and were informed back in 2020 through the pkg-vulnerabilities database.\n\n### NETGEAR __ Affected\n\nNotified: 2020-09-28 Updated: 2021-01-19\n\n**Statement Date: January 14, 2021**\n\n**CVE-2020-25681**| Affected \n---|--- \n**CVE-2020-25682**| Affected \n**CVE-2020-25683**| Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Affected \n \n#### Vendor Statement\n\nNetgear has released fixes for multiple Dnsmasq security vulnerabilities on the following product affected models: RAX40 running firmware versions prior to v1.0.3.88 RAX35 running firmware versions prior to v1.0.3.88\n\nNETGEAR strongly recommends that you download the latest firmware as soon as possible.\n\nYou and follow the steps mentioned in the security advisory to upgrade it to the latest version. https://kb.netgear.com/000062628/Security-Advisory-for-Multiple-Dnsmasq-Vulnerabilities-on-Some-Routers-PSV-2020-0463\n\nThanks, Rachit Dogra\n\n#### References\n\n * <https://kb.netgear.com/000062628/Security-Advisory-for-Multiple-Dnsmasq-Vulnerabilities-on-Some-Routers-PSV-2020-0463>\n\n### OpenWRT __ Affected\n\nNotified: 2020-09-28 Updated: 2021-01-19\n\n**Statement Date: January 19, 2021**\n\n**CVE-2020-25681**| Affected \n---|--- \n**Vendor Statement:** \nOnly package dnsmasq-full, which is not installed by default, is affected. \n**CVE-2020-25682**| Affected \n**Vendor Statement:** \nOnly package dnsmasq-full, which is not installed by default, is affected. \n**CVE-2020-25683**| Affected \n**Vendor Statement:** \nOnly package dnsmasq-full, which is not installed by default, is affected. \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**Vendor Statement:** \nOnly package dnsmasq-full, which is not installed by default, is affected. \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Affected \n**Vendor Statement:** \nOnly package dnsmasq-full, which is not installed by default, is affected. \n \n#### Vendor Statement\n\nOpenWrt shipps the following variants: * dnsmasq * dnsmasq-dhcpv6 * dnsmasq-full\n\nOnly dnsmasq-full has support for DNSSEC and only this variant is affected by the problems in the DNSSEC code as far as we understand them. The other problems affect all variants. The default installation contains the dnsmasq package only, but the user can install the other variants.\n\n#### References\n\n * <https://openwrt.org/advisory/2021-01-19-1>\n\n### Pi-Hole Affected\n\nNotified: 2020-10-12 Updated: 2021-01-19\n\n**Statement Date: January 11, 2021**\n\n**CVE-2020-25681**| Affected \n---|--- \n**CVE-2020-25682**| Affected \n**CVE-2020-25683**| Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Red Hat __ Affected\n\nNotified: 2020-09-25 Updated: 2021-01-19\n\n**Statement Date: January 15, 2021**\n\n**CVE-2020-25681**| Affected \n---|--- \n**Vendor Statement:** \nThis issue affects the versions of dnsmasq as shipped with Red Hat Enterprise Linux 8, but it does not affect the versions of dnsmasq as shipped with Red Hat Enterprise Linux 5, 6, and 7 because they are not compiled with DNSSEC support. \n** References: **\n\n * <https://access.redhat.com/security/cve/cve-2020-25681> \n**CVE-2020-25682**| Affected \n**Vendor Statement:** \nThis issue affects the versions of dnsmasq as shipped with Red Hat Enterprise Linux 8, but it does not affect the versions of dnsmasq as shipped with Red Hat Enterprise Linux 5, 6, and 7 because they are not compiled with DNSSEC support. \n** References: **\n\n * <https://access.redhat.com/security/cve/cve-2020-25682> \n**CVE-2020-25683**| Affected \n**Vendor Statement:** \nThis issue affects the versions of dnsmasq as shipped with Red Hat Enterprise Linux 8, but it does not affect the versions of dnsmasq as shipped with Red Hat Enterprise Linux 5, 6, and 7 because they are not compiled with DNSSEC support. \n** References: **\n\n * <https://access.redhat.com/security/cve/cve-2020-25683> \n**CVE-2020-25684**| Affected \n**Vendor Statement:** \nThis issue affects the versions of dnsmasq as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8. Red Hat OpenStack Platform (RHOSP) and Red Hat Virtualization (RHV) are indirectly affected as well. \n** References: **\n\n * <https://access.redhat.com/security/cve/cve-2020-25684> \n**CVE-2020-25685**| Affected \n**Vendor Statement:** \nThis issue affects the versions of dnsmasq as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8. Red Hat Enterprise Linux 8 provides dnsmasq compiled with DNSSEC support, thus SHA-1 is used as a hash for query names instead of CRC32, making collisions harder to find. Red Hat OpenStack Platform (RHOSP) and Red Hat Virtualization (RHV) are indirectly affected as well. \n** References: **\n\n * <https://access.redhat.com/security/cve/cve-2020-25685> \n**CVE-2020-25686**| Affected \n**Vendor Statement:** \nThis issue affects the versions of dnsmasq as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8. Red Hat OpenStack Platform (RHOSP) and Red Hat Virtualization (RHV) are indirectly affected as well. \n** References: **\n\n * <https://access.redhat.com/security/cve/cve-2020-25686> \n**CVE-2020-25687**| Affected \n**Vendor Statement:** \nThis issue affects the versions of dnsmasq as shipped with Red Hat Enterprise Linux 8, but it does not affect the versions of dnsmasq as shipped with Red Hat Enterprise Linux 5, 6, and 7 because they are not compiled with DNSSEC support. \n** References: **\n\n * <https://access.redhat.com/security/cve/cve-2020-25687> \n \n#### References\n\n * <https://access.redhat.com/security/vulnerabilities/RHSB-2021-001>\n\n### Siemens __ Affected\n\nNotified: 2020-10-12 Updated: 2021-01-19\n\n**Statement Date: January 19, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nSiemens is aware of the security vulnerabilities in the Open Source component DNSmasq, as disclosed on 2021-01-19 and also known as \"DNSpooq\".\n\nThe impact to Siemens products is described in the Security Advisory SSA-646763, published on the Siemens ProductCERT page (https://www.siemens.com/cert/advisories).\n\nIn case of questions regarding this Security Advisory, please contact Siemens ProductCERT (productcert@siemens.com).\n\n#### References\n\n * <https://cert-portal.siemens.com/productcert/pdf/ssa-646763.pdf>\n\n### Sierra Wireless __ Affected\n\nNotified: 2020-09-28 Updated: 2021-01-20\n\n**Statement Date: January 20, 2021**\n\n**CVE-2020-25681**| Affected \n---|--- \n**CVE-2020-25682**| Affected \n**CVE-2020-25683**| Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Affected \n \n#### Vendor Statement\n\nSierra Wireless products are affected by some of these vulnerabilities. Please check the security bulletin linked in the reference section for details on your product. Sierra Wireless would like to thank JSOF for discovering and responsibly reporting these issues, as well as the efforts of CERT/CC for coordinating the response.\n\n#### References\n\n * <https://sierrawireless.com/security>\n * <https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2021-002/>\n\n### Sophos __ Affected\n\nNotified: 2020-09-28 Updated: 2021-01-20\n\n**Statement Date: January 20, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n** References: **\n\n * <https://community.sophos.com/b/security-blog/posts/advisory-resolved-multiple-dnsmasq-vulnerabilities-aka-dnspooq-in-sophos-red> \n**CVE-2020-25682**| Not Affected \n** References: **\n\n * <https://community.sophos.com/b/security-blog/posts/advisory-resolved-multiple-dnsmasq-vulnerabilities-aka-dnspooq-in-sophos-red> \n**CVE-2020-25683**| Not Affected \n** References: **\n\n * <https://community.sophos.com/b/security-blog/posts/advisory-resolved-multiple-dnsmasq-vulnerabilities-aka-dnspooq-in-sophos-red> \n**CVE-2020-25684**| Affected \n** References: **\n\n * <https://community.sophos.com/b/security-blog/posts/advisory-resolved-multiple-dnsmasq-vulnerabilities-aka-dnspooq-in-sophos-red> \n**CVE-2020-25685**| Affected \n** References: **\n\n * <https://community.sophos.com/b/security-blog/posts/advisory-resolved-multiple-dnsmasq-vulnerabilities-aka-dnspooq-in-sophos-red> \n**CVE-2020-25686**| Affected \n** References: **\n\n * <https://community.sophos.com/b/security-blog/posts/advisory-resolved-multiple-dnsmasq-vulnerabilities-aka-dnspooq-in-sophos-red> \n**CVE-2020-25687**| Not Affected \n** References: **\n\n * <https://community.sophos.com/b/security-blog/posts/advisory-resolved-multiple-dnsmasq-vulnerabilities-aka-dnspooq-in-sophos-red> \n \n#### Vendor Statement\n\nSophos Red devices are impacted. More information to follow\n\n#### References\n\n * <https://community.sophos.com/b/security-blog/posts/advisory-resolved-multiple-dnsmasq-vulnerabilities-aka-dnspooq-in-sophos-red>\n\n### SUSE Linux Affected\n\nNotified: 2020-09-28 Updated: 2021-01-19\n\n**Statement Date: January 14, 2021**\n\n**CVE-2020-25681**| Affected \n---|--- \n**CVE-2020-25682**| Affected \n**CVE-2020-25683**| Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Synology __ Affected\n\nNotified: 2020-09-28 Updated: 2021-01-22\n\n**Statement Date: January 21, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n#### References\n\n * <https://www.synology.com/security/advisory/Synology_SA_21_01>\n\n### Technicolor __ Affected\n\nNotified: 2020-09-15 Updated: 2021-01-19\n\n**Statement Date: September 29, 2020**\n\n**CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Affected \n**Vendor Statement:** \nwe confirm that dnsmaq is affected by this vulnerability. however it is very unlikely to see real world exploitation of this vulnerability. It requires dnsmasq to be configured to do DNS requests to a rogue DNS that will serve these unrelated CNAME records. Devices are configured to request ISPs DNS. Moreover, these unrelated CNAME records are not valid and cannot be configured in a regular zone file; they require custom DNS server to be served. So, if you control a custom DNS and you can configure dnsmasq to request this DNS, no need to exploit a vulnerability to poison the cache, just answer what you want. Risk level : LOW CVSS v2 : 3.6 \n** References: **\n\n * <https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:H/Au:N/C:N/I:P/A:P/E:POC/RL:U/RC:C)> \n**CVE-2020-25683**| Not Affected \n**Vendor Statement:** \nDNSSEC is not available on dnsmasq version we use \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n### Wind River Affected\n\nNotified: 2020-09-29 Updated: 2021-01-19\n\n**Statement Date: October 14, 2020**\n\n**CVE-2020-25681**| Affected \n---|--- \n**CVE-2020-25682**| Affected \n**CVE-2020-25683**| Affected \n**CVE-2020-25684**| Affected \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Zephyr Project __ Affected\n\nNotified: 2020-09-29 Updated: 2021-01-19\n\n**Statement Date: October 27, 2020**\n\n**CVE-2020-25681**| Affected \n---|--- \n**CVE-2020-25682**| Affected \n**CVE-2020-25683**| Affected \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Affected \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nThe Zephyr project consists of a core RTOS, numerous additional modules, and an extensive suite of test builds and test cases. This vulnerability does not directly affect the RTOS, or the additional modules. However, some of the test cases use the dnsmasq tool, which could render these testing environment vulnerable. In these test cases, the dnsmasq tool is used strictly by RTOS+test code running within the QEMU simulation environment. Attacks on dnsmasq could result in test failures causing a denial of service to the project (due to incorrect failures).\n\n### A10 Networks __ Not Affected\n\nNotified: 2020-09-23 Updated: 2021-07-20\n\n**Statement Date: June 23, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nDnsmasq is not used in current and supported A10 Networks, Inc products.\n\n### Actiontec __ Not Affected\n\nNotified: 2020-09-23 Updated: 2021-01-19\n\n**Statement Date: January 19, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nwe do not use dnsmasq in our products\n\n### Afero Not Affected\n\nNotified: 2020-09-23 Updated: 2021-01-19\n\n**Statement Date: November 02, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Android Open Source Project __ Not Affected\n\nNotified: 2020-09-23 Updated: 2021-01-19\n\n**Statement Date: November 23, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWhile Android does have Dnsmasq code but it is used in a limited capacity and cannot be attacked or exploited in the manner described in this report.\n\n### AVM GmbH __ Not Affected\n\nNotified: 2020-09-23 Updated: 2021-01-19\n\n**Statement Date: October 30, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**Vendor Statement:** \nAVM does not use dnsmasq \n**CVE-2020-25687**| Not Affected \n**Vendor Statement:** \nAVM does not use dnsmasq \n \n#### Vendor Statement\n\nAVM doesn't use the dnsmasq project within its firmwares.\n\n### Barracuda Networks Not Affected\n\nNotified: 2020-09-23 Updated: 2021-01-19\n\n**Statement Date: January 19, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Blackberry QNX Not Affected\n\nNotified: 2020-09-23 Updated: 2021-01-19\n\n**Statement Date: October 30, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Brocade Communication Systems __ Not Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: November 25, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nNo Brocade Fibre Channel Products from Broadcom are currently known to be affected by these vulnerabilities.\n\n### eCosCentric __ Not Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: November 25, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nDo not use/supply Dnsmasq\n\n### eero __ Not Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: January 15, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\neero products do not use the affected functionality of the affected software products, and so are unaffected by these vulnerabilities.\n\n### Espressif Systems __ Not Affected\n\nNotified: 2020-09-24 Updated: 2021-01-20\n\n**Statement Date: January 20, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nEspressif doesn't use dnsmasq in any product SDKs or other published software, so is not affected.\n\n### F5 Networks __ Not Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: December 05, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**Vendor Statement:** \nThe package dnsmasq and/or associated binaries are not installed on F5 products, therefore they are not affected by these vulnerabilities. \n**CVE-2020-25682**| Not Affected \n**Vendor Statement:** \nThe package dnsmasq and/or associated binaries are not installed on F5 products, therefore they are not affected by these vulnerabilities. \n**CVE-2020-25683**| Not Affected \n**Vendor Statement:** \nThe package dnsmasq and/or associated binaries are not installed on F5 products, therefore they are not affected by these vulnerabilities. \n**CVE-2020-25684**| Not Affected \n**Vendor Statement:** \nThe package dnsmasq and/or associated binaries are not installed on F5 products, therefore they are not affected by these vulnerabilities. \n**CVE-2020-25685**| Not Affected \n**Vendor Statement:** \nThe package dnsmasq and/or associated binaries are not installed on F5 products, therefore they are not affected by these vulnerabilities. \n**CVE-2020-25686**| Not Affected \n**Vendor Statement:** \nThe package dnsmasq and/or associated binaries are not installed on F5 products, therefore they are not affected by these vulnerabilities. \n**CVE-2020-25687**| Not Affected \n**Vendor Statement:** \nThe package dnsmasq and/or associated binaries are not installed on F5 products, therefore they are not affected by these vulnerabilities. \n \n#### Vendor Statement\n\nThe package dnsmasq and/or associated binaries are not installed on F5 products, therefore they are not affected by these vulnerabilities.\n\n### FreeBSD __ Not Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: September 24, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nFreeBSD does not ship with dnsmasq as part of the base system. dnsmasq is available as part of the FreeBSD ports/pkg system, but the responsibility for analysis of risk lies with the administrator that chooses to install and configure dnsmasq.\n\n### F-Secure Corporation __ Not Affected\n\nNotified: 2020-09-24 Updated: 2021-10-06\n\n**Statement Date: June 24, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nNot Affected.\n\n### Google Not Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: December 07, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### HCC Embedded Not Affected\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: November 26, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Infoblox Not Affected\n\nNotified: 2020-09-25 Updated: 2021-01-19\n\n**Statement Date: October 16, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Intel Not Affected\n\nNotified: 2020-09-25 Updated: 2021-01-19\n\n**Statement Date: January 19, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### LANCOM Systems GmbH __ Not Affected\n\nNotified: 2020-09-25 Updated: 2021-01-19\n\n**Statement Date: January 14, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nLANCOM Systems products are not affected by these vulnerabilities.\n\n### lwIP __ Not Affected\n\nNotified: 2020-09-25 Updated: 2021-01-19\n\n**Statement Date: December 04, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nlwIP does not use dnsmasq code. We've had similar bugs like 1 and 2 here in the past (with their own CVE), but these have been fixed quite a while ago.\n\n### Mbed TLS Not Affected\n\nNotified: 2020-09-23 Updated: 2021-01-19\n\n**Statement Date: September 24, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### McAfee Not Affected\n\nNotified: 2020-09-28 Updated: 2021-06-02\n\n**Statement Date: May 17, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### MikroTik __ Not Affected\n\nNotified: 2020-09-28 Updated: 2021-01-19\n\n**Statement Date: September 29, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**Vendor Statement:** \nDnsmasq not used in MikroTik software \n**CVE-2020-25682**| Not Affected \n**Vendor Statement:** \nDnsmasq not used in MikroTik software \n**CVE-2020-25683**| Not Affected \n**Vendor Statement:** \nDnsmasq not used in MikroTik software \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Not Affected \n**Vendor Statement:** \nDnsmasq not used in MikroTik software \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nDnsmasq not used in MikroTik software\n\n### Miredo __ Not Affected\n\nNotified: 2020-09-28 Updated: 2021-01-19\n\n**Statement Date: January 19, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\ndnsmasq is not used.\n\n### netsnmp Not Affected\n\nNotified: 2020-09-28 Updated: 2021-01-19\n\n**Statement Date: October 30, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Paessler Not Affected\n\nNotified: 2020-09-28 Updated: 2022-11-21\n\n**Statement Date: March 28, 2022**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Peplink Not Affected\n\nNotified: 2020-09-28 Updated: 2021-10-06\n\n**Statement Date: September 16, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Pulse Secure Not Affected\n\nNotified: 2020-09-28 Updated: 2021-02-11\n\n**Statement Date: February 10, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Rockwell Automation Not Affected\n\nNotified: 2020-09-28 Updated: 2021-01-19\n\n**Statement Date: November 30, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Treck __ Not Affected\n\nNotified: 2020-09-29 Updated: 2021-06-02\n\n**Statement Date: April 25, 2021**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nTreck does not use Dnsmasq.\n\n### VMware Not Affected\n\nNotified: 2020-09-29 Updated: 2021-01-19\n\n**Statement Date: November 03, 2020**\n\n**CVE-2020-25681**| Not Affected \n---|--- \n**CVE-2020-25682**| Not Affected \n**CVE-2020-25683**| Not Affected \n**CVE-2020-25684**| Not Affected \n**CVE-2020-25685**| Not Affected \n**CVE-2020-25686**| Not Affected \n**CVE-2020-25687**| Not Affected \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Ceragon Networks Inc __ Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: January 18, 2021**\n\n**CVE-2020-25681**| Unknown \n---|--- \n**Vendor Statement:** \nnot relevant \n**CVE-2020-25682**| Unknown \n**Vendor Statement:** \nnot relevant \n**CVE-2020-25683**| Unknown \n**Vendor Statement:** \nnot relevant \n**CVE-2020-25684**| Unknown \n**Vendor Statement:** \nnot relevant \n**CVE-2020-25685**| Unknown \n**Vendor Statement:** \nnot relevant \n**CVE-2020-25686**| Unknown \n**Vendor Statement:** \nnot relevant \n**CVE-2020-25687**| Unknown \n**Vendor Statement:** \nnot relevant \n \n### D-Link Systems Inc. __ Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19\n\n**Statement Date: September 30, 2020**\n\n**CVE-2020-25681**| Unknown \n---|--- \n**Vendor Statement:** \nD-Link has been informed that DNSmasq, a popular caching DNS server and DHCP server, is vulnerable to DNS cache poisoning attacks. We have promptly started our investigation to determine whether D-Link routers are affected, and we will provide updates as soon as we have more information. D-Link takes the issues of network security and user privacy very seriously. We have a dedicated task force and product management team on call to address evolving security issues and implement appropriate security measures. Please check the D-Link website for updates. \n** References: **\n\n * security@dlink.com \n**CVE-2020-25682**| Unknown \n**Vendor Statement:** \nD-Link has been informed that DNSmasq, a popular caching DNS server and DHCP server, is vulnerable to DNS cache poisoning attacks. We have promptly started our investigation to determine whether D-Link routers are affected, and we will provide updates as soon as we have more information. D-Link takes the issues of network security and user privacy very seriously. We have a dedicated task force and product management team on call to address evolving security issues and implement appropriate security measures. Please check the D-Link website for updates. \n** References: **\n\n * security@dlink.com \n**CVE-2020-25683**| Unknown \n**Vendor Statement:** \nD-Link has been informed that DNSmasq, a popular caching DNS server and DHCP server, is vulnerable to DNS cache poisoning attacks. We have promptly started our investigation to determine whether D-Link routers are affected, and we will provide updates as soon as we have more information. D-Link takes the issues of network security and user privacy very seriously. We have a dedicated task force and product management team on call to address evolving security issues and implement appropriate security measures. Please check the D-Link website for updates. \n** References: **\n\n * security@dlink.com \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**Vendor Statement:** \nD-Link has been informed that DNSmasq, a popular caching DNS server and DHCP server, is vulnerable to DNS cache poisoning attacks. We have promptly started our investigation to determine whether D-Link routers are affected, and we will provide updates as soon as we have more information. D-Link takes the issues of network security and user privacy very seriously. We have a dedicated task force and product management team on call to address evolving security issues and implement appropriate security measures. Please check the D-Link website for updates. \n** References: **\n\n * security@dlink.com \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nD-Link has been informed that DNSmasq, a popular caching DNS server and DHCP server, is vulnerable to DNS cache poisoning attacks. We have promptly started our investigation to determine whether D-Link routers are affected, and we will provide updates as soon as we have more information.\n\nD-Link takes the issues of network security and user privacy very seriously. We have a dedicated task force and product management team on call to address evolving security issues and implement appropriate security measures. Please check the D-Link website for updates.\n\n#### References\n\n * security@dlink.com\n\n### IBM Corporation (zseries) __ Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19\n\n**Statement Date: September 29, 2020**\n\n**CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nAs a best practice for IBM Z, IBM strongly recommends that clients obtain access to the IBM Z and LinuxONE Security Portal and subscribe to the Security Portal\u2019s automatic notification process to get access to the latest service information on security and system integrity related APARs for z/OS and z/VM.\n\n### ACCESS Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Actelis Networks Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### ADATA Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### ADTRAN Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Aerohive Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### AhnLab Inc Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### AirWatch Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Akamai Technologies Inc. Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Alcatel-Lucent Enterprise Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Allied Telesis Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Alpine Linux Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Altran Intelligent Systems Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Amazon Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### ANTlabs Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Apple Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Arch Linux Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### ARRIS Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Aruba Networks Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Aspera Inc. Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### ASUSTeK Computer Inc. Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Atheros Communications Inc Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### AT&amp;T Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Avaya Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Belden Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Belkin Inc. Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Bell Canada Enterprises Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### BlackBerry Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### BlueCat Networks Inc. Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Blue Coat Systems Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Blunk Microsystems Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### BoringSSL Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Broadcom Unknown\n\nNotified: 2020-09-23 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Buffalo Technology Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### BullGuard Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Cambium Networks Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### CA Technologies Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### CERT-UBIK Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Cesanta Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Cirpack Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### CMX Systems Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Comcast Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Commscope Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Contiki OS Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Cricket Wireless Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Cypress Semiconductor Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### CZ.NIC Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Debian GNU/Linux Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Dell Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Dell EMC Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Dell SecureWorks Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Deutsche Telekom Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Devicescape Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Diebold Election Systems Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### dnsmasq Unknown\n\nNotified: 2020-09-18 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### EfficientIP Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### ENEA Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Ericsson Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### European Registry for Internet Domains Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Express Logic Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Extreme Networks Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Fastly Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Fedora Project Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### FNet Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Force10 Networks Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Fortinet Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Foundry Brocade Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### FreeRTOS Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Geexbox Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Gentoo Linux Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### GFI Software Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### GNU adns Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### GNU glibc Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Grandstream Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Green Hills Software Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Hewlett Packard Enterprise Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Hitachi Unknown\n\nNotified: 2020-09-24 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Hitron Unknown\n\nNotified: 2021-01-19 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Honeywell Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### HP Inc. Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### HTC Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Huawei Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### IBM Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### IBM Numa-Q Division (Formerly Sequent) Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### ICASI Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### InfoExpress Inc. Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Inmarsat Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Internet Systems Consortium Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Internet Systems Consortium - DHCP Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### INTEROP Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### IP Infusion Inc. Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### JH Software Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### JPCERT/CC Vulnerability Handling Team Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Kwikset Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Lancope Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Lantronix Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Lenovo Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### LG Electronics Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### LibreSSL Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Linksys Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### LITE-ON Technology Corporation Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### LiteSpeed Technologies Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Lynx Software Technologies Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### m0n0wall Unknown\n\nNotified: 2020-09-25 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Marconi Inc. Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Marvell Semiconductor Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### MaxLinear Unknown\n\nNotified: 2021-01-13 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### MediaTek Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Medtronic Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Men &amp; Mice Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Metaswitch Networks Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Micrium Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Microchip Technology Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Micro Focus Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Microsoft Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Minim Unknown\n\nNotified: 2021-01-19 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Mitel Networks Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Monroe Electronics Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Motorola Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Muonics Inc. Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### National Cyber Security Center Netherlands Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### National Cyber Security Centre Finland Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### NCSC-FI Vulnerability Coordinator Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### NEC Corporation Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### NetBurner Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### NetComm Wireless Limited Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### NETSCOUT Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### netsnmpj Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### NIKSUN Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Nixu Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### NLnet Labs Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Nokia Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Nominum Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### OleumTech Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### OpenConnect Ltd Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### OpenDNS Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### OpenSSL Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Openwall GNU/*/Linux Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Oracle Corporation Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Oryx Embedded Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Palo Alto Networks Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### pfSense Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Philips Electronics Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### PHPIDS Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### PowerDNS Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Proxim Inc. Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### QLogic Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### QNAP Unknown\n\nNotified: 2020-10-08 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Quadros Systems Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Quagga Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Qualcomm Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Quantenna Communications Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Riverbed Technologies Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Roku Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Ruckus Wireless Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Ruijie Networks Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### SafeNet Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Samsung Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Samsung Mobile Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Samsung Semiconductor Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Schneider Electric Unknown\n\nNotified: 2020-12-08 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Secure64 Software Corporation Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### SEIKO EPSON Corp. / Epson America Inc. Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Slackware Linux Inc. Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### SMC Networks Inc. Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### SmoothWall Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Snort Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### SonicWall Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Sonos Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Sony Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Sourcefire Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Symantec Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Systech Unknown\n\nNotified: 2020-09-28 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### systemd Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### TCPWave Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### TDS Telecom Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Tenable Network Security Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Thales Group Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19\n\n**Statement Date: September 30, 2020**\n\n**CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### TippingPoint Technologies Inc. Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Tizen Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Toshiba Commerce Solutions Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### TP-LINK Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Turbolinux Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Ubee Interactive Unknown\n\nNotified: 2021-01-19 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Ubiquiti Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Ubuntu Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Unisys Corporation Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Univention Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Untangle Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vertical Networks Inc. Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### VMware Carbon Black Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vultures List Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### WizNET Technology Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### wolfSSL Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Xiaomi Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Xilinx Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Zebra Technologies Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### ZTE Corporation Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Zyxel Unknown\n\nNotified: 2020-09-29 Updated: 2021-01-19 **CVE-2020-25681**| Unknown \n---|--- \n**CVE-2020-25682**| Unknown \n**CVE-2020-25683**| Unknown \n**CVE-2020-25684**| Unknown \n**CVE-2020-25685**| Unknown \n**CVE-2020-25686**| Unknown \n**CVE-2020-25687**| Unknown \n \n#### Vendor Statement\n\nWe have not received a statement from the vendor.\n\nView all 253 vendors __View less vendors __\n\n \n\n\n### References\n\n * <https://www.kb.cert.org/vuls/id/800113>\n * <https://kb.cert.org/vuls/id/973527>\n * <https://transition.fcc.gov/bureaus/pshs/advisory/csric3/CSRICIII_9-12-12_WG4-FINAL-Report-DNS-Best-Practices.pdf>\n * <https://astrolavos.gatech.edu/articles/increased_dns_resistance.pdf>\n * <https://www.icann.org/news/blog/security-best-practices-dnssec-validation>\n * <http://www.thekelleys.org.uk/dnsmasq/doc.html>\n * <https://www.jsof-tech.com/disclosures/dnspooq>\n\n### Other Information\n\n**CVE IDs:** | [CVE-2020-25681 ](<http://web.nvd.nist.gov/vuln/detail/CVE-2020-25681>) [CVE-2020-25682 ](<http://web.nvd.nist.gov/vuln/detail/CVE-2020-25682>) [CVE-2020-25683 ](<http://web.nvd.nist.gov/vuln/detail/CVE-2020-25683>) [CVE-2020-25684 ](<http://web.nvd.nist.gov/vuln/detail/CVE-2020-25684>) [CVE-2020-25685 ](<http://web.nvd.nist.gov/vuln/detail/CVE-2020-25685>) [CVE-2020-25686 ](<http://web.nvd.nist.gov/vuln/detail/CVE-2020-25686>) [CVE-2020-25687 ](<http://web.nvd.nist.gov/vuln/detail/CVE-2020-25687>) \n---|--- \n**API URL: ** | VINCE JSON | CSAF \n**Date Public:** | 2021-01-19 \n**Date First Published:** | 2021-01-19 \n**Date Last Updated: ** | 2023-06-20 15:43 UTC \n**Document Revision: ** | 13 \n", "published": "2021-01-19T00:00:00", "modified": "2023-06-20T15:43:00", "epss": [{"cve": "CVE-2020-25681", "epss": 0.15937, "percentile": 0.9539, "modified": "2023-12-02"}, {"cve": "CVE-2020-25682", "epss": 0.10872, "percentile": 0.94528, "modified": "2023-12-02"}, {"cve": "CVE-2020-25683", "epss": 0.08665, "percentile": 0.93843, "modified": "2023-12-02"}, {"cve": "CVE-2020-25684", "epss": 0.00831, "percentile": 0.79983, "modified": "2023-12-02"}, {"cve": "CVE-2020-25685", "epss": 0.00394, "percentile": 0.70397, "modified": "2023-12-02"}, {"cve": "CVE-2020-25686", "epss": 0.00378, "percentile": 0.6979, "modified": "2023-12-02"}, {"cve": "CVE-2020-25687", "epss": 0.08665, "percentile": 0.93843, "modified": "2023-12-02"}], "cvss": {"score": 8.3, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:C", "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "COMPLETE", "baseScore": 8.3}, "severity": "HIGH", "exploitabilityScore": 8.6, "impactScore": 8.5, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}, "href": "https://www.kb.cert.org/vuls/id/434904", "reporter": "CERT", "references": ["https://www.kb.cert.org/vuls/id/800113", "https://kb.cert.org/vuls/id/973527", "https://transition.fcc.gov/bureaus/pshs/advisory/csric3/CSRICIII_9-12-12_WG4-FINAL-Report-DNS-Best-Practices.pdf", "https://astrolavos.gatech.edu/articles/increased_dns_resistance.pdf", "https://www.icann.org/news/blog/security-best-practices-dnssec-validation", "http://www.thekelleys.org.uk/dnsmasq/doc.html", "https://www.jsof-tech.com/disclosures/dnspooq"], "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "immutableFields": [], "lastseen": "2023-12-02T17:30:13", "viewCount": 129, "enchantments": {"dependencies": {"references": [{"type": "almalinux", "idList": ["ALSA-2021:0150"]}, {"type": "alpinelinux", "idList": ["ALPINE:CVE-2020-25681", "ALPINE:CVE-2020-25682", "ALPINE:CVE-2020-25683", "ALPINE:CVE-2020-25684", "ALPINE:CVE-2020-25685", "ALPINE:CVE-2020-25686", "ALPINE:CVE-2020-25687"]}, {"type": "altlinux", "idList": ["864D4BAD00FC35A95D316BFD81ABFD93"]}, {"type": "amazon", "idList": ["ALAS2-2021-1587"]}, {"type": "archlinux", "idList": ["ASA-202101-38"]}, {"type": "arista", "idList": ["ARISTA:0061"]}, {"type": "cbl_mariner", "idList": ["CBLMARINER:3788", "CBLMARINER:3789", "CBLMARINER:3790", "CBLMARINER:3813", "CBLMARINER:3814", "CBLMARINER:3815", "CBLMARINER:3816"]}, {"type": "centos", "idList": ["CESA-2021:0153"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2020-3597"]}, {"type": "cisco", "idList": ["CISCO-SA-DNSMASQ-DNS-2021-C5MRDF3G"]}, {"type": "cve", "idList": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"]}, {"type": "debian", "idList": ["DEBIAN:DLA-2604-1:9EC79", "DEBIAN:DSA-4844-1:75AB4", "DEBIAN:DSA-4844-1:99BC8"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2020-25681", "DEBIANCVE:CVE-2020-25682", "DEBIANCVE:CVE-2020-25683", "DEBIANCVE:CVE-2020-25684", "DEBIANCVE:CVE-2020-25685", "DEBIANCVE:CVE-2020-25686", "DEBIANCVE:CVE-2020-25687"]}, {"type": "f5", "idList": ["F5:K02931614", "F5:K98221124"]}, {"type": "fedora", "idList": ["FEDORA:5278930BDD92", "FEDORA:5AB7E30E25EB"]}, {"type": "freebsd", "idList": ["5B5CF6E5-5B51-11EB-95AC-7F9491278677"]}, {"type": "gentoo", "idList": ["GLSA-202101-17"]}, {"type": "githubexploit", "idList": ["CBF3EF2D-3A5B-5110-A374-4A5ADE9AC91A"]}, {"type": "ibm", "idList": ["FC73553AD2A105EE66740C14C0933AC41AB9E38FE9977D31F31C0B40B28F3F0A"]}, {"type": "ics", "idList": ["ICSA-21-019-01"]}, {"type": "mageia", "idList": ["MGASA-2021-0059"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:663327DFA13BEF28EEE013C568D709A6"]}, {"type": "nessus", "idList": ["AL2_ALAS-2021-1587.NASL", "CENTOS8_RHSA-2021-0150.NASL", "CENTOS_RHSA-2021-0153.NASL", "DEBIAN_DLA-2604.NASL", "DEBIAN_DSA-4844.NASL", "DNSMASQ_2_83.NASL", "EULEROS_SA-2021-1138.NASL", "EULEROS_SA-2021-1244.NASL", "EULEROS_SA-2021-1263.NASL", "EULEROS_SA-2021-1288.NASL", "EULEROS_SA-2021-1374.NASL", "EULEROS_SA-2021-1389.NASL", "EULEROS_SA-2021-1411.NASL", "EULEROS_SA-2021-1469.NASL", "EULEROS_SA-2021-1551.NASL", "EULEROS_SA-2021-1673.NASL", "EULEROS_SA-2021-1733.NASL", "EULEROS_SA-2021-1758.NASL", "EULEROS_SA-2021-1775.NASL", "EULEROS_SA-2021-2134.NASL", "FEDORA_2021-2E4C3D5A9D.NASL", "FEDORA_2021-84440E87BA.NASL", "FREEBSD_PKG_5B5CF6E55B5111EB95AC7F9491278677.NASL", "GENTOO_GLSA-202101-17.NASL", "NEWSTART_CGSL_NS-SA-2021-0091_DNSMASQ.NASL", "NEWSTART_CGSL_NS-SA-2021-0098_DNSMASQ.NASL", "NEWSTART_CGSL_NS-SA-2021-0125_DNSMASQ.NASL", "NEWSTART_CGSL_NS-SA-2021-0183_DNSMASQ.NASL", "NUTANIX_NXSA-AHV-20201105_1045.NASL", "OPENSUSE-2021-124.NASL", "OPENSUSE-2021-129.NASL", "ORACLELINUX_ELSA-2021-0150.NASL", "ORACLELINUX_ELSA-2021-0153.NASL", "ORACLELINUX_ELSA-2023-12971.NASL", "ORACLELINUX_ELSA-2023-12972.NASL", "PHOTONOS_PHSA-2021-1_0-0356_DNSMASQ.NASL", "PHOTONOS_PHSA-2021-2_0-0312_DNSMASQ.NASL", "PHOTONOS_PHSA-2021-3_0-0186_DNSMASQ.NASL", "REDHAT-RHSA-2021-0150.NASL", "REDHAT-RHSA-2021-0151.NASL", "REDHAT-RHSA-2021-0152.NASL", "REDHAT-RHSA-2021-0153.NASL", "REDHAT-RHSA-2021-0154.NASL", "REDHAT-RHSA-2021-0155.NASL", "REDHAT-RHSA-2021-0156.NASL", "REDHAT-RHSA-2021-0240.NASL", "REDHAT-RHSA-2021-0245.NASL", "REDHAT-RHSA-2021-0395.NASL", "REDHAT-RHSA-2021-0401.NASL", "SLACKWARE_SSA_2021-040-01.NASL", "SL_20210119_DNSMASQ_ON_SL7_X.NASL", "SUSE_SU-2021-0162-1.NASL", "SUSE_SU-2021-0163-1.NASL", "SUSE_SU-2021-0166-1.NASL", "SUSE_SU-2021-14603-1.NASL", "UBUNTU_USN-4698-1.NASL"]}, {"type": "openwrt", "idList": ["OPENWRT-SA-2021-01-19-1"]}, {"type": "oraclelinux", "idList": ["ELSA-2021-0150", "ELSA-2021-0153"]}, {"type": "osv", "idList": ["OSV:CVE-2020-25681", "OSV:CVE-2020-25682", "OSV:CVE-2020-25685", "OSV:DSA-4844-1"]}, {"type": "photon", "idList": ["PHSA-2021-0186", "PHSA-2021-0312", "PHSA-2021-0356", "PHSA-2021-1.0-0356", "PHSA-2021-2.0-0312", "PHSA-2021-3.0-0186"]}, {"type": "prion", "idList": ["PRION:CVE-2020-25681", "PRION:CVE-2020-25682", "PRION:CVE-2020-25683", "PRION:CVE-2020-25684", "PRION:CVE-2020-25685", "PRION:CVE-2020-25686", "PRION:CVE-2020-25687"]}, {"type": "redhat", "idList": ["RHSA-2020:5633", "RHSA-2021:0150", "RHSA-2021:0151", "RHSA-2021:0152", "RHSA-2021:0153", "RHSA-2021:0154", "RHSA-2021:0155", "RHSA-2021:0156", "RHSA-2021:0240", "RHSA-2021:0245", "RHSA-2021:0281", "RHSA-2021:0395", "RHSA-2021:0401", "RHSA-2021:0799"]}, {"type": "redhatcve", "idList": ["RH:CVE-2020-25681", "RH:CVE-2020-25682", "RH:CVE-2020-25683", "RH:CVE-2020-25684", "RH:CVE-2020-25685", "RH:CVE-2020-25686", "RH:CVE-2020-25687"]}, {"type": "rosalinux", "idList": ["ROSA-SA-2021-1823"]}, {"type": "slackware", "idList": ["SSA-2021-040-01"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2021:0124-1", "OPENSUSE-SU-2021:0129-1"]}, {"type": "thn", "idList": ["THN:5CFE6070F72F17DAC9AFD3A651C741D8"]}, {"type": "threatpost", "idList": ["THREATPOST:8B647363122969148DB6173D5DA44833"]}, {"type": "ubuntu", "idList": ["USN-4698-1", "USN-4698-2"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2020-25681", "UB:CVE-2020-25682", "UB:CVE-2020-25683", "UB:CVE-2020-25684", "UB:CVE-2020-25685", "UB:CVE-2020-25686", "UB:CVE-2020-25687"]}, {"type": "veracode", "idList": ["VERACODE:29040", "VERACODE:29041", "VERACODE:29042", "VERACODE:29043", "VERACODE:29044", "VERACODE:29045", "VERACODE:29046"]}]}, "score": {"value": 8.7, "vector": "NONE"}, "backreferences": {"references": [{"type": "almalinux", "idList": ["ALSA-2021:0150"]}, {"type": "amazon", "idList": ["ALAS2-2021-1587"]}, {"type": "archlinux", "idList": ["ASA-202101-38"]}, {"type": "centos", "idList": ["CESA-2021:0153"]}, {"type": "cisa", "idList": ["CISA:DA0E01C44A71E3E0D68B5BD82B943475"]}, {"type": "cisco", "idList": ["CISCO-SA-DNSMASQ-DNS-2021-C5MRDF3G"]}, {"type": "cve", "idList": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"]}, {"type": "debian", "idList": ["DEBIAN:DSA-4844-1:99BC8"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2020-25681", "DEBIANCVE:CVE-2020-25682", "DEBIANCVE:CVE-2020-25683", "DEBIANCVE:CVE-2020-25684", "DEBIANCVE:CVE-2020-25685", "DEBIANCVE:CVE-2020-25686", "DEBIANCVE:CVE-2020-25687"]}, {"type": "f5", "idList": ["F5:K02931614", "F5:K98221124"]}, {"type": "fedora", "idList": ["FEDORA:5278930BDD92", "FEDORA:5AB7E30E25EB"]}, {"type": "freebsd", "idList": ["5B5CF6E5-5B51-11EB-95AC-7F9491278677"]}, {"type": "gentoo", "idList": ["GLSA-202101-17"]}, {"type": "githubexploit", "idList": ["CBF3EF2D-3A5B-5110-A374-4A5ADE9AC91A"]}, {"type": "ibm", "idList": ["FC73553AD2A105EE66740C14C0933AC41AB9E38FE9977D31F31C0B40B28F3F0A"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:663327DFA13BEF28EEE013C568D709A6"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/CENTOS_LINUX-CVE-2020-25681/", "MSF:ILITIES/CENTOS_LINUX-CVE-2020-25682/", "MSF:ILITIES/CENTOS_LINUX-CVE-2020-25683/", "MSF:ILITIES/CENTOS_LINUX-CVE-2020-25685/", "MSF:ILITIES/CENTOS_LINUX-CVE-2020-25686/", "MSF:ILITIES/FREEBSD-CVE-2020-25681/", "MSF:ILITIES/FREEBSD-CVE-2020-25683/", "MSF:ILITIES/FREEBSD-CVE-2020-25687/", "MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-25681/", "MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-25685/", "MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-25686/", "MSF:ILITIES/ORACLE-SOLARIS-CVE-2020-25684/", "MSF:ILITIES/ORACLE_LINUX-CVE-2020-25684/", "MSF:ILITIES/ORACLE_LINUX-CVE-2020-25685/", "MSF:ILITIES/ORACLE_LINUX-CVE-2020-25686/", "MSF:ILITIES/REDHAT_LINUX-CVE-2020-25686/"]}, {"type": "nessus", "idList": ["AL2_ALAS-2021-1587.NASL", "CENTOS8_RHSA-2021-0150.NASL", "CENTOS_RHSA-2021-0153.NASL", "DEBIAN_DSA-4844.NASL", "DNSMASQ_2_83.NASL", "EULEROS_SA-2021-1138.NASL", "EULEROS_SA-2021-1244.NASL", "EULEROS_SA-2021-1263.NASL", "EULEROS_SA-2021-1288.NASL", "EULEROS_SA-2021-1374.NASL", "EULEROS_SA-2021-1733.NASL", "EULEROS_SA-2021-1758.NASL", "EULEROS_SA-2021-1775.NASL", "EULEROS_SA-2021-2134.NASL", "FEDORA_2021-2E4C3D5A9D.NASL", "FEDORA_2021-84440E87BA.NASL", "FREEBSD_PKG_5B5CF6E55B5111EB95AC7F9491278677.NASL", "GENTOO_GLSA-202101-17.NASL", "OPENSUSE-2021-124.NASL", "OPENSUSE-2021-129.NASL", "ORACLELINUX_ELSA-2021-0150.NASL", "ORACLELINUX_ELSA-2021-0153.NASL", "PHOTONOS_PHSA-2021-1_0-0356_DNSMASQ.NASL", "PHOTONOS_PHSA-2021-2_0-0312_DNSMASQ.NASL", "PHOTONOS_PHSA-2021-3_0-0186_DNSMASQ.NASL", "REDHAT-RHSA-2021-0150.NASL", "REDHAT-RHSA-2021-0151.NASL", "REDHAT-RHSA-2021-0152.NASL", "REDHAT-RHSA-2021-0153.NASL", "REDHAT-RHSA-2021-0154.NASL", "REDHAT-RHSA-2021-0155.NASL", "REDHAT-RHSA-2021-0156.NASL", "REDHAT-RHSA-2021-0240.NASL", "REDHAT-RHSA-2021-0245.NASL", "REDHAT-RHSA-2021-0395.NASL", "REDHAT-RHSA-2021-0401.NASL", "SLACKWARE_SSA_2021-040-01.NASL", "SL_20210119_DNSMASQ_ON_SL7_X.NASL", "SUSE_SU-2021-0162-1.NASL", "SUSE_SU-2021-0163-1.NASL", "SUSE_SU-2021-0166-1.NASL", "SUSE_SU-2021-14603-1.NASL", "UBUNTU_USN-4698-1.NASL"]}, {"type": "openwrt", "idList": ["OPENWRT-SA-2021-01-19-1"]}, {"type": "oraclelinux", "idList": ["ELSA-2021-0150", "ELSA-2021-0153"]}, {"type": "photon", "idList": ["PHSA-2021-1.0-0356", "PHSA-2021-2.0-0312", "PHSA-2021-3.0-0186"]}, {"type": "redhat", "idList": ["RHSA-2021:0150", "RHSA-2021:0151", "RHSA-2021:0153", "RHSA-2021:0245"]}, {"type": "redhatcve", "idList": ["RH:CVE-2020-25681", "RH:CVE-2020-25682", "RH:CVE-2020-25683", "RH:CVE-2020-25685", "RH:CVE-2020-25686", "RH:CVE-2020-25687"]}, {"type": "slackware", "idList": ["SSA-2021-040-01"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2021:0124-1", "OPENSUSE-SU-2021:0129-1"]}, {"type": "talos", "idList": ["SAP"]}, {"type": "thn", "idList": ["THN:5CFE6070F72F17DAC9AFD3A651C741D8"]}, {"type": "threatpost", "idList": ["THREATPOST:8B647363122969148DB6173D5DA44833"]}, {"type": "ubuntu", "idList": ["USN-4698-1", "USN-4698-2"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2020-25681", "UB:CVE-2020-25683", "UB:CVE-2020-25684", "UB:CVE-2020-25685", "UB:CVE-2020-25686", "UB:CVE-2020-25687"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2020-25681", "epss": 0.4619, "percentile": 0.96865, "modified": "2023-05-07"}, {"cve": "CVE-2020-25682", "epss": 0.28679, "percentile": 0.96215, "modified": "2023-05-07"}, {"cve": "CVE-2020-25683", "epss": 0.23975, "percentile": 0.95876, "modified": "2023-05-07"}, {"cve": "CVE-2020-25684", "epss": 0.00297, "percentile": 0.64786, "modified": "2023-05-07"}, {"cve": "CVE-2020-25685", "epss": 0.00119, "percentile": 0.44568, "modified": "2023-05-07"}, {"cve": "CVE-2020-25686", "epss": 0.00175, "percentile": 0.53192, "modified": "2023-05-07"}, {"cve": "CVE-2020-25687", "epss": 0.23975, "percentile": 0.95876, "modified": "2023-05-07"}], "vulnersScore": 8.7}, "_state": {"dependencies": 1701539092, "score": 1701538863, "epss": 0}, "_internal": {"score_hash": "3695dd0af6d41a130807a968cb754db5"}}

{"oraclelinux": [{"lastseen": "2021-07-28T14:24:32", "description": "[2.79-13.1]\n- Fix various issues in dnssec validation (CVE-2020-25681)\n- Accept responses only on correct sockets (CVE-2020-25684)\n- Use strong verification on queries (CVE-2020-25685)", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-01-20T00:00:00", "type": "oraclelinux", "title": "dnsmasq security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "COMPLETE", "integrityImpact": "PARTIAL", "baseScore": 8.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 8.5, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2021-01-20T00:00:00", "id": "ELSA-2021-0150", "href": "http://linux.oracle.com/errata/ELSA-2021-0150.html", "cvss": {"score": 8.3, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:C"}}, {"lastseen": "2021-07-28T14:24:34", "description": "[2.76-16.1]\n- Accept responses only on correct sockets (CVE-2020-25684)\n- Use strong verification on queries (CVE-2020-25685)\n- Handle multiple identical DNS queries better (CVE-2020-25686)\n- Link against nettle for sha256 hash implementation", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "NONE", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 3.7, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 1.4}, "published": "2021-01-19T00:00:00", "type": "oraclelinux", "title": "dnsmasq security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686"], "modified": "2021-01-19T00:00:00", "id": "ELSA-2021-0153", "href": "http://linux.oracle.com/errata/ELSA-2021-0153.html", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "nessus": [{"lastseen": "2023-10-27T15:18:17", "description": "The remote NewStart CGSL host, running version MAIN 6.02, has dnsmasq packages installed that are affected by multiple vulnerabilities:\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap- allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-10-27T00:00:00", "type": "nessus", "title": "NewStart CGSL MAIN 6.02 : dnsmasq Multiple Vulnerabilities (NS-SA-2021-0125)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:zte:cgsl_main:dnsmasq", "p-cpe:/a:zte:cgsl_main:dnsmasq-debuginfo", "p-cpe:/a:zte:cgsl_main:dnsmasq-debugsource", "p-cpe:/a:zte:cgsl_main:dnsmasq-utils", "p-cpe:/a:zte:cgsl_main:dnsmasq-utils-debuginfo", "cpe:/o:zte:cgsl_main:6"], "id": "NEWSTART_CGSL_NS-SA-2021-0125_DNSMASQ.NASL", "href": "https://www.tenable.com/plugins/nessus/154463", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2021-0125. The text\n# itself is copyright (C) ZTE, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(154463);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"NewStart CGSL MAIN 6.02 : dnsmasq Multiple Vulnerabilities (NS-SA-2021-0125)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote NewStart CGSL host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version MAIN 6.02, has dnsmasq packages installed that are affected by multiple\nvulnerabilities:\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS\n replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with\n arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from\n this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq\n extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who\n can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-\n allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from\n the base buffer, thus reducing, in practice, the number of available bytes that can be written in the\n buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as\n system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in the forward.c:reply_query() if the reply destination address/port is used by the pending\n forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query,\n substantially reducing the number of attempts an attacker on the network would have to perform to forge a\n reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's\n attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful\n attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a\n weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1\n when it is) this flaw allows an off-path attacker to find several different domains all having the same\n hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the\n attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards a new request. By default, a maximum of 150\n pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that\n it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the\n Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a\n successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2021-0125\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-25681\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-25682\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-25683\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-25684\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-25685\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-25686\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/info/CVE-2020-25687\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL dnsmasq packages. Note that updated packages may not be available yet. Please contact ZTE\nfor more information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/09/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/10/27\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:dnsmasq-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:dnsmasq-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:zte:cgsl_main:dnsmasq-utils-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:zte:cgsl_main:6\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar release = get_kb_item('Host/ZTE-CGSL/release');\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');\n\nif (release !~ \"CGSL MAIN 6.02\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 6.02');\n\nif (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);\n\nvar flag = 0;\n\nvar pkgs = {\n 'CGSL MAIN 6.02': [\n 'dnsmasq-2.79-13.el8_3.1',\n 'dnsmasq-debuginfo-2.79-13.el8_3.1',\n 'dnsmasq-debugsource-2.79-13.el8_3.1',\n 'dnsmasq-utils-2.79-13.el8_3.1',\n 'dnsmasq-utils-debuginfo-2.79-13.el8_3.1'\n ]\n};\nvar pkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:'ZTE ' + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:00:59", "description": "The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-84440e87ba advisory.\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap- allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-21T00:00:00", "type": "nessus", "title": "Fedora 33 : dnsmasq (2021-84440e87ba)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:33", "p-cpe:/a:fedoraproject:fedora:dnsmasq"], "id": "FEDORA_2021-84440E87BA.NASL", "href": "https://www.tenable.com/plugins/nessus/145241", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n##\n# The descriptive text and package checks in this plugin were\n# extracted from Fedora Security Advisory FEDORA-2021-84440e87ba\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145241);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"FEDORA\", value:\"2021-84440e87ba\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Fedora 33 : dnsmasq (2021-84440e87ba)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Fedora host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the\nFEDORA-2021-84440e87ba advisory.\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS\n replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with\n arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from\n this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq\n extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who\n can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-\n allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from\n the base buffer, thus reducing, in practice, the number of available bytes that can be written in the\n buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as\n system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in the forward.c:reply_query() if the reply destination address/port is used by the pending\n forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query,\n substantially reducing the number of attempts an attacker on the network would have to perform to forge a\n reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's\n attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful\n attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a\n weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1\n when it is) this flaw allows an off-path attacker to find several different domains all having the same\n hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the\n attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards a new request. By default, a maximum of 150\n pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that\n it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the\n Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a\n successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2021-84440e87ba\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/21\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:33\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:dnsmasq\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Fedora Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/RedHat/release');\nif (isnull(release) || 'Fedora' >!< release) audit(AUDIT_OS_NOT, 'Fedora');\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^33([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Fedora 33', 'Fedora ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);\n\npkgs = [\n {'reference':'dnsmasq-2.83-1.fc33', 'release':'FC33', 'rpm_spec_vers_cmp':TRUE}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:01:49", "description": "This update for dnsmasq fixes the following issues :\n\n - bsc#1177077: Fixed DNSpooq vulnerabilities\n\n - CVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache Poisoning attacks.\n\n - CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed multiple potential Heap-based overflows when DNSSEC is enabled.\n\n - Retry query to other servers on receipt of SERVFAIL rcode (bsc#1176076)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.", "cvss3": {}, "published": "2021-01-25T00:00:00", "type": "nessus", "title": "openSUSE Security Update : dnsmasq (openSUSE-2021-129)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:novell:opensuse:15.1", "p-cpe:/a:novell:opensuse:dnsmasq", "p-cpe:/a:novell:opensuse:dnsmasq-debuginfo", "p-cpe:/a:novell:opensuse:dnsmasq-debugsource", "p-cpe:/a:novell:opensuse:dnsmasq-utils", "p-cpe:/a:novell:opensuse:dnsmasq-utils-debuginfo"], "id": "OPENSUSE-2021-129.NASL", "href": "https://www.tenable.com/plugins/nessus/145295", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2021-129.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145295);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"openSUSE Security Update : dnsmasq (openSUSE-2021-129)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote openSUSE host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for dnsmasq fixes the following issues :\n\n - bsc#1177077: Fixed DNSpooq vulnerabilities\n\n - CVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed\n multiple Cache Poisoning attacks.\n\n - CVE-2020-25681, CVE-2020-25682, CVE-2020-25683,\n CVE-2020-25687: Fixed multiple potential Heap-based\n overflows when DNSSEC is enabled.\n\n - Retry query to other servers on receipt of SERVFAIL\n rcode (bsc#1176076)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update\nproject.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1176076\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1177077\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq-utils-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"dnsmasq-2.78-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"dnsmasq-debuginfo-2.78-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"dnsmasq-debugsource-2.78-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"dnsmasq-utils-2.78-lp151.5.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"dnsmasq-utils-debuginfo-2.78-lp151.5.6.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq / dnsmasq-debuginfo / dnsmasq-debugsource / dnsmasq-utils / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:01:46", "description": "According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network,who can create valid DNS replies,could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory,possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function,which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However,in some code execution paths,it is possible extract_name() gets passed an offset from the base buffer,thus reducing,in practice,the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-02-01T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP8 : dnsmasq (EulerOS-SA-2021-1138)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "p-cpe:/a:huawei:euleros:dnsmasq-utils", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2021-1138.NASL", "href": "https://www.tenable.com/plugins/nessus/145737", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145737);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS 2.0 SP8 : dnsmasq (EulerOS-SA-2021-1138)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in the forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in forward.c:reply_query(), which is the forwarded\n query that matches the reply, by only using a weak hash\n of the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n sort_rrset() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq before 2.83. A buffer\n overflow vulnerability was discovered in the way\n dnsmasq extract names from DNS packets before\n validating them with DNSSEC data. An attacker on the\n network,who can create valid DNS replies,could use this\n flaw to cause an overflow with arbitrary data in a\n heap-allocated memory,possibly executing code on the\n machine. The flaw is in the rfc1035.c:extract_name()\n function,which writes data to the memory pointed by\n name assuming MAXDNAME*2 bytes are available in the\n buffer. However,in some code execution paths,it is\n possible extract_name() gets passed an offset from the\n base buffer,thus reducing,in practice,the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies\n such as that they are accepted as valid, could use this\n flaw to cause a buffer overflow with arbitrary data in\n a heap memory segment, possibly executing code on the\n machine. The highest threat from this vulnerability is\n to data confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before version 2.83. When\n receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards\n a new request. By default, a maximum of 150 pending\n queries can be sent to upstream servers, so there can\n be at most 150 queries for the same name. This flaw\n allows an off-path attacker on the network to\n substantially reduce the number of attempts that it\n would have to perform to forge a reply and have it\n accepted by dnsmasq. This issue is mentioned in the\n 'Birthday Attacks' section of RFC5452. If chained with\n CVE-2020-25684, the attack complexity of a successful\n attack is reduced. The highest threat from this\n vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n get_rdata() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25683)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1138\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?54ff6184\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(8)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.79-7.h5.eulerosv2r8\",\n \"dnsmasq-utils-2.79-7.h5.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"8\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:00:58", "description": "The version of dnsmasq installed on the remote host is prior to 2.83. It is, therefore, affected by multiple vulnerabilities:\n\n - Multiple remote buffer overflows in the DNSSEC implementation. (CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687)\n\n - A UDP DNS cache poisoning vulnerability. (CVE-2020-25684)\n\n - Usage of a known weak hashing function. (CVE-2020-25685)\n\n - An issue handling multiple simultaneous DNS queries. (CVE-2020-25686)\n\n Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-19T00:00:00", "type": "nessus", "title": "dnsmasq < 2.83 Multiple Vulnerabilities (DNSPOOQ)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-07T00:00:00", "cpe": ["cpe:/a:thekelleys:dnsmasq"], "id": "DNSMASQ_2_83.NASL", "href": "https://www.tenable.com/plugins/nessus/145073", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145073);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/07\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"dnsmasq < 2.83 Multiple Vulnerabilities (DNSPOOQ)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote DNS / DHCP service is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of dnsmasq installed on the remote host is prior to 2.83. It is, therefore, affected by multiple\nvulnerabilities:\n\n - Multiple remote buffer overflows in the DNSSEC implementation. (CVE-2020-25681, CVE-2020-25682, CVE-2020-25683,\n CVE-2020-25687)\n\n - A UDP DNS cache poisoning vulnerability. (CVE-2020-25684)\n\n - Usage of a known weak hashing function. (CVE-2020-25685)\n\n - An issue handling multiple simultaneous DNS queries. (CVE-2020-25686)\n\n Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\n number.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.thekelleys.org.uk/dnsmasq/CHANGELOG\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.jsof-tech.com/disclosures/dnspooq/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to dnsmasq 2.83 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/19\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:thekelleys:dnsmasq\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"DNS\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"dns_version.nasl\");\n script_require_keys(\"dns_server/version\", \"Settings/ParanoidReport\");\n script_require_ports(\"Services/dns\", 53);\n\n exit(0);\n}\n\ninclude('audit.inc');\n\napp_name = 'dnsmasq';\nport = get_kb_item('Services/udp/dns');\n\nif (!port)\n port = 53;\n\nif (report_paranoia < 2)\n audit(AUDIT_PARANOID);\n\n# dnsmasq replies to BIND.VERSION\nversion = tolower(get_kb_item_or_exit('dns_server/version'));\ndisplay_version = version;\n\nif (version !~ \"dnsmasq-(v)?\")\n audit(AUDIT_NOT_LISTEN, app_name, port);\n\nversion = preg_replace(pattern:\"^dnsmasq-(v)?(.*)$\", replace:\"\\2\", string:version);\n\nif (version == '2')\n audit(AUDIT_VER_NOT_GRANULAR, app_name, port, display_version);\n\nfix = '2.83';\nif (ver_compare(ver:version, fix:fix, strict:FALSE) >= 0)\n audit(AUDIT_LISTEN_NOT_VULN, app_name, port, version, 'udp');\n\nreport = '\\n' +\n '\\n Installed version : ' + display_version +\n '\\n Fixed version : dnsmasq-' + fix +\n '\\n';\n\nsecurity_report_v4(port:port, proto:'udp', severity:SECURITY_HOLE, extra:report);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:02:13", "description": "An update of the dnsmasq package has been released.", "cvss3": {}, "published": "2021-01-26T00:00:00", "type": "nessus", "title": "Photon OS 1.0: Dnsmasq PHSA-2021-1.0-0356", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:vmware:photonos:dnsmasq", "cpe:/o:vmware:photonos:1.0"], "id": "PHOTONOS_PHSA-2021-1_0-0356_DNSMASQ.NASL", "href": "https://www.tenable.com/plugins/nessus/145420", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2021-1.0-0356. The text\n# itself is copyright (C) VMware, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145420);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Photon OS 1.0: Dnsmasq PHSA-2021-1.0-0356\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote PhotonOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of the dnsmasq package has been released.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://github.com/vmware/photon/wiki/Security-Updates-1.0-356.md\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected Linux packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/26\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:1.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item('Host/PhotonOS/release');\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, 'PhotonOS');\nif (release !~ \"^VMware Photon (?:Linux|OS) 1\\.0(\\D|$)\") audit(AUDIT_OS_NOT, 'PhotonOS 1.0');\n\nif (!get_kb_item('Host/PhotonOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'PhotonOS', cpu);\n\nflag = 0;\n\nif (rpm_check(release:'PhotonOS-1.0', cpu:'x86_64', reference:'dnsmasq-2.82-1.ph1')) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:07:07", "description": "The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-2e4c3d5a9d advisory.\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap- allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-04-19T00:00:00", "type": "nessus", "title": "Fedora 32 : dnsmasq (2021-2e4c3d5a9d)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:32", "p-cpe:/a:fedoraproject:fedora:dnsmasq"], "id": "FEDORA_2021-2E4C3D5A9D.NASL", "href": "https://www.tenable.com/plugins/nessus/148783", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n##\n# The descriptive text and package checks in this plugin were\n# extracted from Fedora Security Advisory FEDORA-2021-2e4c3d5a9d\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(148783);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"FEDORA\", value:\"2021-2e4c3d5a9d\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Fedora 32 : dnsmasq (2021-2e4c3d5a9d)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Fedora host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the\nFEDORA-2021-2e4c3d5a9d advisory.\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS\n replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with\n arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from\n this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq\n extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who\n can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-\n allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from\n the base buffer, thus reducing, in practice, the number of available bytes that can be written in the\n buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as\n system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in the forward.c:reply_query() if the reply destination address/port is used by the pending\n forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query,\n substantially reducing the number of attempts an attacker on the network would have to perform to forge a\n reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's\n attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful\n attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a\n weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1\n when it is) this flaw allows an off-path attacker to find several different domains all having the same\n hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the\n attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards a new request. By default, a maximum of 150\n pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that\n it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the\n Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a\n successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2021-2e4c3d5a9d\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/04/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:32\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:dnsmasq\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Fedora Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/RedHat/release');\nif (isnull(release) || 'Fedora' >!< release) audit(AUDIT_OS_NOT, 'Fedora');\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^32([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Fedora 32', 'Fedora ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);\n\npkgs = [\n {'reference':'dnsmasq-2.84-1.fc32', 'release':'FC32', 'rpm_spec_vers_cmp':TRUE}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:03:23", "description": "According to the versions of the dnsmasq package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-02-05T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP9 : dnsmasq (EulerOS-SA-2021-1244)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:huawei:euleros:2.0", "p-cpe:/a:huawei:euleros:dnsmasq"], "id": "EULEROS_SA-2021-1244.NASL", "href": "https://www.tenable.com/plugins/nessus/146218", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146218);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS 2.0 SP9 : dnsmasq (EulerOS-SA-2021-1244)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq package installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies\n such as that they are accepted as valid, could use this\n flaw to cause a buffer overflow with arbitrary data in\n a heap memory segment, possibly executing code on the\n machine. The highest threat from this vulnerability is\n to data confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer\n overflow vulnerability was discovered in the way\n dnsmasq extract names from DNS packets before\n validating them with DNSSEC data. An attacker on the\n network, who can create valid DNS replies, could use\n this flaw to cause an overflow with arbitrary data in a\n heap-allocated memory, possibly executing code on the\n machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by\n name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is\n possible extract_name() gets passed an offset from the\n base buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n get_rdata() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in the forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in forward.c:reply_query(), which is the forwarded\n query that matches the reply, by only using a weak hash\n of the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When\n receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards\n a new request. By default, a maximum of 150 pending\n queries can be sent to upstream servers, so there can\n be at most 150 queries for the same name. This flaw\n allows an off-path attacker on the network to\n substantially reduce the number of attempts that it\n would have to perform to forge a reply and have it\n accepted by dnsmasq. This issue is mentioned in the\n 'Birthday Attacks' section of RFC5452. If chained with\n CVE-2020-25684, the attack complexity of a successful\n attack is reduced. The highest threat from this\n vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n sort_rrset() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1244\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?1cc63d9c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(9)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP9\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP9\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.81-1.h5.eulerosv2r9\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"9\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:03:23", "description": "According to the versions of the dnsmasq package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-02-05T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP9 : dnsmasq (EulerOS-SA-2021-1263)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2021-1263.NASL", "href": "https://www.tenable.com/plugins/nessus/146224", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146224);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS 2.0 SP9 : dnsmasq (EulerOS-SA-2021-1263)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq package installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies\n such as that they are accepted as valid, could use this\n flaw to cause a buffer overflow with arbitrary data in\n a heap memory segment, possibly executing code on the\n machine. The highest threat from this vulnerability is\n to data confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer\n overflow vulnerability was discovered in the way\n dnsmasq extract names from DNS packets before\n validating them with DNSSEC data. An attacker on the\n network, who can create valid DNS replies, could use\n this flaw to cause an overflow with arbitrary data in a\n heap-allocated memory, possibly executing code on the\n machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by\n name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is\n possible extract_name() gets passed an offset from the\n base buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n get_rdata() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in the forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in forward.c:reply_query(), which is the forwarded\n query that matches the reply, by only using a weak hash\n of the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When\n receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards\n a new request. By default, a maximum of 150 pending\n queries can be sent to upstream servers, so there can\n be at most 150 queries for the same name. This flaw\n allows an off-path attacker on the network to\n substantially reduce the number of attempts that it\n would have to perform to forge a reply and have it\n accepted by dnsmasq. This issue is mentioned in the\n 'Birthday Attacks' section of RFC5452. If chained with\n CVE-2020-25684, the attack complexity of a successful\n attack is reduced. The highest threat from this\n vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n sort_rrset() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1263\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b30dbebc\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(9)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP9\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP9\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.81-1.h5.eulerosv2r9\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"9\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:00:58", "description": "An update of the dnsmasq package has been released.", "cvss3": {}, "published": "2021-01-26T00:00:00", "type": "nessus", "title": "Photon OS 2.0: Dnsmasq PHSA-2021-2.0-0312", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:vmware:photonos:dnsmasq", "cpe:/o:vmware:photonos:2.0"], "id": "PHOTONOS_PHSA-2021-2_0-0312_DNSMASQ.NASL", "href": "https://www.tenable.com/plugins/nessus/145421", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2021-2.0-0312. The text\n# itself is copyright (C) VMware, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145421);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Photon OS 2.0: Dnsmasq PHSA-2021-2.0-0312\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote PhotonOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of the dnsmasq package has been released.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://github.com/vmware/photon/wiki/Security-Updates-2-312.md\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected Linux packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/26\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item('Host/PhotonOS/release');\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, 'PhotonOS');\nif (release !~ \"^VMware Photon (?:Linux|OS) 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, 'PhotonOS 2.0');\n\nif (!get_kb_item('Host/PhotonOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'PhotonOS', cpu);\n\nflag = 0;\n\nif (rpm_check(release:'PhotonOS-2.0', cpu:'x86_64', reference:'dnsmasq-2.82-1.ph2')) flag++;\nif (rpm_check(release:'PhotonOS-2.0', cpu:'x86_64', reference:'dnsmasq-utils-2.82-1.ph2')) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:03:22", "description": "Moshe Kol and Shlomi Oberman of JSOF discovered several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server. They could result in denial of service, cache poisoning or the execution of arbitrary code.", "cvss3": {}, "published": "2021-02-05T00:00:00", "type": "nessus", "title": "Debian DSA-4844-1 : dnsmasq - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-06T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:dnsmasq", "cpe:/o:debian:debian_linux:10.0"], "id": "DEBIAN_DSA-4844.NASL", "href": "https://www.tenable.com/plugins/nessus/146242", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4844. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(146242);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/06\");\n\n script_cve_id(\"CVE-2020-25681\", \"CVE-2020-25682\", \"CVE-2020-25683\", \"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\", \"CVE-2020-25687\");\n script_xref(name:\"DSA\", value:\"4844\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Debian DSA-4844-1 : dnsmasq - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Moshe Kol and Shlomi Oberman of JSOF discovered several\nvulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP\nserver. They could result in denial of service, cache poisoning or the\nexecution of arbitrary code.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/dnsmasq\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/buster/dnsmasq\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2021/dsa-4844\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Upgrade the dnsmasq packages.\n\nFor the stable distribution (buster), these problems have been fixed\nin version 2.80-1+deb10u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:10.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/05\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"10.0\", prefix:\"dnsmasq\", reference:\"2.80-1+deb10u1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"dnsmasq-base\", reference:\"2.80-1+deb10u1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"dnsmasq-base-lua\", reference:\"2.80-1+deb10u1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"dnsmasq-utils\", reference:\"2.80-1+deb10u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-29T14:55:31", "description": "An update of the dnsmasq package has been released.", "cvss3": {}, "published": "2021-01-26T00:00:00", "type": "nessus", "title": "Photon OS 3.0: Dnsmasq PHSA-2021-3.0-0186", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:vmware:photonos:dnsmasq", "cpe:/o:vmware:photonos:3.0"], "id": "PHOTONOS_PHSA-2021-3_0-0186_DNSMASQ.NASL", "href": "https://www.tenable.com/plugins/nessus/145414", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2021-3.0-0186. The text\n# itself is copyright (C) VMware, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145414);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Photon OS 3.0: Dnsmasq PHSA-2021-3.0-0186\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote PhotonOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of the dnsmasq package has been released.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://github.com/vmware/photon/wiki/Security-Updates-3.0-186.md\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected Linux packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/26\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:3.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item('Host/PhotonOS/release');\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, 'PhotonOS');\nif (release !~ \"^VMware Photon (?:Linux|OS) 3\\.0(\\D|$)\") audit(AUDIT_OS_NOT, 'PhotonOS 3.0');\n\nif (!get_kb_item('Host/PhotonOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'PhotonOS', cpu);\n\nflag = 0;\n\nif (rpm_check(release:'PhotonOS-3.0', cpu:'x86_64', reference:'dnsmasq-2.82-1.ph3')) flag++;\nif (rpm_check(release:'PhotonOS-3.0', cpu:'x86_64', reference:'dnsmasq-utils-2.82-1.ph3')) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:03:08", "description": "According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-02-22T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP2 : dnsmasq (EulerOS-SA-2021-1288)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "p-cpe:/a:huawei:euleros:dnsmasq-utils", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2021-1288.NASL", "href": "https://www.tenable.com/plugins/nessus/146697", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146697);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS 2.0 SP2 : dnsmasq (EulerOS-SA-2021-1288)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies\n such as that they are accepted as valid, could use this\n flaw to cause a buffer overflow with arbitrary data in\n a heap memory segment, possibly executing code on the\n machine. The highest threat from this vulnerability is\n to data confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer\n overflow vulnerability was discovered in the way\n dnsmasq extract names from DNS packets before\n validating them with DNSSEC data. An attacker on the\n network, who can create valid DNS replies, could use\n this flaw to cause an overflow with arbitrary data in a\n heap-allocated memory, possibly executing code on the\n machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by\n name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is\n possible extract_name() gets passed an offset from the\n base buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n get_rdata() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in the forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in forward.c:reply_query(), which is the forwarded\n query that matches the reply, by only using a weak hash\n of the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When\n receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards\n a new request. By default, a maximum of 150 pending\n queries can be sent to upstream servers, so there can\n be at most 150 queries for the same name. This flaw\n allows an off-path attacker on the network to\n substantially reduce the number of attempts that it\n would have to perform to forge a reply and have it\n accepted by dnsmasq. This issue is mentioned in the\n 'Birthday Attacks' section of RFC5452. If chained with\n CVE-2020-25684, the attack complexity of a successful\n attack is reduced. The highest threat from this\n vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n sort_rrset() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1288\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?d535ebc4\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.76-2.2.h3\",\n \"dnsmasq-utils-2.76-2.2.h3\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:03:23", "description": "According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-02-22T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP3 : dnsmasq (EulerOS-SA-2021-1374)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "p-cpe:/a:huawei:euleros:dnsmasq-utils", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2021-1374.NASL", "href": "https://www.tenable.com/plugins/nessus/146735", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146735);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS 2.0 SP3 : dnsmasq (EulerOS-SA-2021-1374)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies\n such as that they are accepted as valid, could use this\n flaw to cause a buffer overflow with arbitrary data in\n a heap memory segment, possibly executing code on the\n machine. The highest threat from this vulnerability is\n to data confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer\n overflow vulnerability was discovered in the way\n dnsmasq extract names from DNS packets before\n validating them with DNSSEC data. An attacker on the\n network, who can create valid DNS replies, could use\n this flaw to cause an overflow with arbitrary data in a\n heap-allocated memory, possibly executing code on the\n machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by\n name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is\n possible extract_name() gets passed an offset from the\n base buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n get_rdata() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in the forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in forward.c:reply_query(), which is the forwarded\n query that matches the reply, by only using a weak hash\n of the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When\n receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards\n a new request. By default, a maximum of 150 pending\n queries can be sent to upstream servers, so there can\n be at most 150 queries for the same name. This flaw\n allows an off-path attacker on the network to\n substantially reduce the number of attempts that it\n would have to perform to forge a reply and have it\n accepted by dnsmasq. This issue is mentioned in the\n 'Birthday Attacks' section of RFC5452. If chained with\n CVE-2020-25684, the attack complexity of a successful\n attack is reduced. The highest threat from this\n vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n sort_rrset() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1374\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?f777cedc\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(3)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.76-2.2.h3\",\n \"dnsmasq-utils-2.76-2.2.h3\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"3\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:07:32", "description": "According to the versions of the dnsmasq package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-04-15T00:00:00", "type": "nessus", "title": "EulerOS Virtualization 2.9.0 : dnsmasq (EulerOS-SA-2021-1758)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "cpe:/o:huawei:euleros:uvp:2.9.0"], "id": "EULEROS_SA-2021-1758.NASL", "href": "https://www.tenable.com/plugins/nessus/148581", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(148581);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS Virtualization 2.9.0 : dnsmasq (EulerOS-SA-2021-1758)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq package installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. This flaw allows a remote attacker, who can\n create valid DNS replies, to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in sort_rrset() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When receiving a query,\n dnsmasq does not check for an existing pending request\n for the same name and forwards a new request. By\n default, a maximum of 150 pending queries can be sent\n to upstream servers, so there can be at most 150\n queries for the same name. This flaw allows an off-path\n attacker on the network to substantially reduce the\n number of attempts that it would have to perform to\n forge a reply and have it accepted by dnsmasq. This\n issue is mentioned in the 'Birthday Attacks' section of\n RFC5452. If chained with CVE-2020-25684, the attack\n complexity of a successful attack is reduced. The\n highest threat from this vulnerability is to data\n integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq. When getting a reply from\n a forwarded query, dnsmasq checks in\n forward.c:reply_query(), which is the forwarded query\n that matches the reply, by only using a weak hash of\n the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When getting a reply from\n a forwarded query, dnsmasq checks in the\n forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. A remote attacker, who can create valid DNS\n replies, could use this flaw to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in get_rdata() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. A buffer overflow\n vulnerability was discovered in the way dnsmasq extract\n names from DNS packets before validating them with\n DNSSEC data. An attacker on the network, who can create\n valid DNS replies, could use this flaw to cause an\n overflow with arbitrary data in a heap-allocated\n memory, possibly executing code on the machine. The\n flaw is in the rfc1035.c:extract_name() function, which\n writes data to the memory pointed by name assuming\n MAXDNAME*2 bytes are available in the buffer. However,\n in some code execution paths, it is possible\n extract_name() gets passed an offset from the base\n buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in the way RRSets are sorted\n before validating with DNSSEC data. An attacker on the\n network, who can forge DNS replies such as that they\n are accepted as valid, could use this flaw to cause a\n buffer overflow with arbitrary data in a heap memory\n segment, possibly executing code on the machine. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1758\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?465f8959\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/04/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/04/15\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:2.9.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"2.9.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 2.9.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.81-1.h6.eulerosv2r9\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:02:12", "description": "This update for dnsmasq fixes the following issues :\n\nbsc#1177077: Fixed DNSpooq vulnerabilities\n\nCVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache Poisoning attacks.\n\nCVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed multiple potential Heap-based overflows when DNSSEC is enabled.\n\nRetry query to other servers on receipt of SERVFAIL rcode (bsc#1176076)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-01-20T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : dnsmasq (SUSE-SU-2021:0162-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-07T00:00:00", "cpe": ["cpe:/o:novell:suse_linux:15", "p-cpe:/a:novell:suse_linux:dnsmasq", "p-cpe:/a:novell:suse_linux:dnsmasq-debuginfo", "p-cpe:/a:novell:suse_linux:dnsmasq-debugsource"], "id": "SUSE_SU-2021-0162-1.NASL", "href": "https://www.tenable.com/plugins/nessus/145199", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2021:0162-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145199);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/07\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"SUSE SLES15 Security Update : dnsmasq (SUSE-SU-2021:0162-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for dnsmasq fixes the following issues :\n\nbsc#1177077: Fixed DNSpooq vulnerabilities\n\nCVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache\nPoisoning attacks.\n\nCVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed\nmultiple potential Heap-based overflows when DNSSEC is enabled.\n\nRetry query to other servers on receipt of SERVFAIL rcode\n(bsc#1176076)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1176076\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1177077\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25681/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25682/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25683/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25684/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25685/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25686/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25687/\");\n # https://www.suse.com/support/update/announcement/2021/suse-su-20210162-1\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?882d5276\");\n script_set_attribute(attribute:\"solution\", value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server for SAP 15 :\n\nzypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2021-162=1\n\nSUSE Linux Enterprise Server 15-LTSS :\n\nzypper in -t patch SUSE-SLE-Product-SLES-15-2021-162=1\n\nSUSE Linux Enterprise High Performance Computing 15-LTSS :\n\nzypper in -t patch SUSE-SLE-Product-HPC-15-2021-162=1\n\nSUSE Linux Enterprise High Performance Computing 15-ESPOS :\n\nzypper in -t patch SUSE-SLE-Product-HPC-15-2021-162=1\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"s390x\") audit(AUDIT_ARCH_NOT, \"s390x\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"dnsmasq-2.78-3.11.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"dnsmasq-debuginfo-2.78-3.11.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"dnsmasq-debugsource-2.78-3.11.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:00:15", "description": "This update for dnsmasq fixes the following issues :\n\nbsc#1177077: Fixed DNSpooq vulnerabilities\n\nCVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache Poisoning attacks.\n\nCVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed multiple potential Heap-based overflows when DNSSEC is enabled.\n\nRetry query to other servers on receipt of SERVFAIL rcode (bsc#1176076)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-01-20T00:00:00", "type": "nessus", "title": "SUSE SLED15 / SLES15 Security Update : dnsmasq (SUSE-SU-2021:0163-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:dnsmasq", "p-cpe:/a:novell:suse_linux:dnsmasq-debuginfo", "p-cpe:/a:novell:suse_linux:dnsmasq-debugsource", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2021-0163-1.NASL", "href": "https://www.tenable.com/plugins/nessus/145108", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2021:0163-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145108);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"SUSE SLED15 / SLES15 Security Update : dnsmasq (SUSE-SU-2021:0163-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for dnsmasq fixes the following issues :\n\nbsc#1177077: Fixed DNSpooq vulnerabilities\n\nCVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache\nPoisoning attacks.\n\nCVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed\nmultiple potential Heap-based overflows when DNSSEC is enabled.\n\nRetry query to other servers on receipt of SERVFAIL rcode\n(bsc#1176076)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1176076\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1177077\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25681/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25682/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25683/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25684/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25685/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25686/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25687/\");\n # https://www.suse.com/support/update/announcement/2021/suse-su-20210163-1\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?f0170268\");\n script_set_attribute(attribute:\"solution\", value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Module for Basesystem 15-SP2 :\n\nzypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2021-163=1\n\nSUSE Linux Enterprise Module for Basesystem 15-SP1 :\n\nzypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2021-163=1\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED15|SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED15 / SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(1|2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP1/2\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED15\" && (! preg(pattern:\"^(1|2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED15 SP1/2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"dnsmasq-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"dnsmasq-debuginfo-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"dnsmasq-debugsource-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"dnsmasq-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"dnsmasq-debuginfo-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"dnsmasq-debugsource-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"dnsmasq-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"dnsmasq-debuginfo-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"dnsmasq-debugsource-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"2\", reference:\"dnsmasq-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"2\", reference:\"dnsmasq-debuginfo-2.78-7.6.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"2\", reference:\"dnsmasq-debugsource-2.78-7.6.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:02:12", "description": "The remote host is affected by the vulnerability described in GLSA-202101-17 (Dnsmasq: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Dnsmasq. Please review the references below for details.\n Impact :\n\n An attacker, by sending specially crafted DNS replies, could possibly execute arbitrary code with the privileges of the process, perform a cache poisoning attack or cause a Denial of Service condition.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {}, "published": "2021-01-25T00:00:00", "type": "nessus", "title": "GLSA-202101-17 : Dnsmasq: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-06T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:dnsmasq", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-202101-17.NASL", "href": "https://www.tenable.com/plugins/nessus/145282", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 202101-17.\n#\n# The advisory text is Copyright (C) 2001-2022 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(145282);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/06\");\n\n script_cve_id(\"CVE-2020-25681\", \"CVE-2020-25682\", \"CVE-2020-25683\", \"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\", \"CVE-2020-25687\");\n script_xref(name:\"GLSA\", value:\"202101-17\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"GLSA-202101-17 : Dnsmasq: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The remote host is affected by the vulnerability described in GLSA-202101-17\n(Dnsmasq: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Dnsmasq. Please review\n the references below for details.\n \nImpact :\n\n An attacker, by sending specially crafted DNS replies, could possibly\n execute arbitrary code with the privileges of the process, perform a\n cache poisoning attack or cause a Denial of Service condition.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/202101-17\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"All Dnsmasq users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-dns/dnsmasq-2.83'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-dns/dnsmasq\", unaffected:make_list(\"ge 2.83\"), vulnerable:make_list(\"lt 2.83\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:02:59", "description": "New dnsmasq packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.", "cvss3": {}, "published": "2021-02-10T00:00:00", "type": "nessus", "title": "Slackware 14.0 / 14.1 / 14.2 / current : dnsmasq (SSA:2021-040-01)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:slackware:slackware_linux:dnsmasq", "cpe:/o:slackware:slackware_linux", "cpe:/o:slackware:slackware_linux:14.0", "cpe:/o:slackware:slackware_linux:14.1", "cpe:/o:slackware:slackware_linux:14.2"], "id": "SLACKWARE_SSA_2021-040-01.NASL", "href": "https://www.tenable.com/plugins/nessus/146369", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2021-040-01. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146369);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"SSA\", value:\"2021-040-01\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Slackware 14.0 / 14.1 / 14.2 / current : dnsmasq (SSA:2021-040-01)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Slackware host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"New dnsmasq packages are available for Slackware 14.0, 14.1, 14.2,\nand -current to fix security issues.\");\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2021&m=slackware-security.585069\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?fb3c1958\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.2\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Slackware Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"14.0\", pkgname:\"dnsmasq\", pkgver:\"2.84\", pkgarch:\"i486\", pkgnum:\"1_slack14.0\")) flag++;\nif (slackware_check(osver:\"14.0\", arch:\"x86_64\", pkgname:\"dnsmasq\", pkgver:\"2.84\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.0\")) flag++;\n\nif (slackware_check(osver:\"14.1\", pkgname:\"dnsmasq\", pkgver:\"2.84\", pkgarch:\"i486\", pkgnum:\"1_slack14.1\")) flag++;\nif (slackware_check(osver:\"14.1\", arch:\"x86_64\", pkgname:\"dnsmasq\", pkgver:\"2.84\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.1\")) flag++;\n\nif (slackware_check(osver:\"14.2\", pkgname:\"dnsmasq\", pkgver:\"2.84\", pkgarch:\"i586\", pkgnum:\"1_slack14.2\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"dnsmasq\", pkgver:\"2.84\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.2\")) flag++;\n\nif (slackware_check(osver:\"current\", pkgname:\"dnsmasq\", pkgver:\"2.84\", pkgarch:\"i586\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"current\", arch:\"x86_64\", pkgname:\"dnsmasq\", pkgver:\"2.84\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:slackware_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:01:47", "description": "Simon Kelley reports :\n\nThere are broadly two sets of problems. The first is subtle errors in dnsmasq's protections against the chronic weakness of the DNS protocol to cache-poisoning attacks; the Birthday attack, Kaminsky, etc.[...]\n\nthe second set of errors is a good old fashioned buffer overflow in dnsmasq's DNSSEC code. If DNSSEC validation is enabled, an installation is at risk.", "cvss3": {}, "published": "2021-01-21T00:00:00", "type": "nessus", "title": "FreeBSD : dnsmasq -- DNS cache poisoning, and DNSSEC buffer overflow, vulnerabilities (5b5cf6e5-5b51-11eb-95ac-7f9491278677)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:dnsmasq", "p-cpe:/a:freebsd:freebsd:dnsmasq-devel", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_5B5CF6E55B5111EB95AC7F9491278677.NASL", "href": "https://www.tenable.com/plugins/nessus/145236", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2021 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145236);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"FreeBSD : dnsmasq -- DNS cache poisoning, and DNSSEC buffer overflow, vulnerabilities (5b5cf6e5-5b51-11eb-95ac-7f9491278677)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"Simon Kelley reports :\n\nThere are broadly two sets of problems. The first is subtle errors in\ndnsmasq's protections against the chronic weakness of the DNS protocol\nto cache-poisoning attacks; the Birthday attack, Kaminsky, etc.[...]\n\nthe second set of errors is a good old fashioned buffer overflow in\ndnsmasq's DNSSEC code. If DNSSEC validation is enabled, an\ninstallation is at risk.\");\n # https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b6f14801\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.jsof-tech.com/disclosures/dnspooq/\");\n # https://vuxml.freebsd.org/freebsd/5b5cf6e5-5b51-11eb-95ac-7f9491278677.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?27a57b8d\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/21\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:dnsmasq-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"dnsmasq<2.83\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"dnsmasq-devel<2.83\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:00:15", "description": "The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0150 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled (CVE-2020-25683)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled (CVE-2020-25687)\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled (CVE-2020-25682)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-19T00:00:00", "type": "nessus", "title": "Oracle Linux 8 : dnsmasq (ELSA-2021-0150)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-07T00:00:00", "cpe": ["cpe:/o:oracle:linux:8", "p-cpe:/a:oracle:linux:dnsmasq", "p-cpe:/a:oracle:linux:dnsmasq-utils"], "id": "ORACLELINUX_ELSA-2021-0150.NASL", "href": "https://www.tenable.com/plugins/nessus/145086", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2021-0150.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145086);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/07\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Oracle Linux 8 : dnsmasq (ELSA-2021-0150)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2021-0150 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path\n attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled\n (CVE-2020-25683)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled\n (CVE-2020-25687)\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled\n (CVE-2020-25682)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2021-0150.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:dnsmasq-utils\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 8', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\npkgs = [\n {'reference':'dnsmasq-2.79-13.el8_3.1', 'cpu':'aarch64', 'release':'8'},\n {'reference':'dnsmasq-2.79-13.el8_3.1', 'cpu':'x86_64', 'release':'8'},\n {'reference':'dnsmasq-utils-2.79-13.el8_3.1', 'cpu':'aarch64', 'release':'8'},\n {'reference':'dnsmasq-utils-2.79-13.el8_3.1', 'cpu':'x86_64', 'release':'8'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n rpm_prefix = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['rpm_prefix'])) rpm_prefix = package_array['rpm_prefix'];\n if (reference && release) {\n if (rpm_prefix) {\n if (rpm_exists(release:release, rpm:rpm_prefix) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:06:02", "description": "The remote NewStart CGSL host, running version MAIN 6.02, has dnsmasq packages installed that are affected by multiple vulnerabilities:\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap- allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-03-10T00:00:00", "type": "nessus", "title": "NewStart CGSL MAIN 6.02 : dnsmasq Multiple Vulnerabilities (NS-SA-2021-0091)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": [], "id": "NEWSTART_CGSL_NS-SA-2021-0091_DNSMASQ.NASL", "href": "https://www.tenable.com/plugins/nessus/147341", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2021-0091. The text\n# itself is copyright (C) ZTE, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147341);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"NewStart CGSL MAIN 6.02 : dnsmasq Multiple Vulnerabilities (NS-SA-2021-0091)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote machine is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version MAIN 6.02, has dnsmasq packages installed that are affected by multiple\nvulnerabilities:\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS\n replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with\n arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from\n this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq\n extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who\n can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-\n allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from\n the base buffer, thus reducing, in practice, the number of available bytes that can be written in the\n buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as\n system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in the forward.c:reply_query() if the reply destination address/port is used by the pending\n forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query,\n substantially reducing the number of attempts an attacker on the network would have to perform to forge a\n reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's\n attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful\n attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a\n weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1\n when it is) this flaw allows an off-path attacker to find several different domains all having the same\n hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the\n attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards a new request. By default, a maximum of 150\n pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that\n it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the\n Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a\n successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2021-0091\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL dnsmasq packages. Note that updated packages may not be available yet. Please contact ZTE\nfor more information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item('Host/ZTE-CGSL/release');\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');\n\nif (release !~ \"CGSL MAIN 6.02\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 6.02');\n\nif (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);\n\nflag = 0;\n\npkgs = {\n 'CGSL MAIN 6.02': [\n 'dnsmasq-2.79-13.el8_3.1',\n 'dnsmasq-debuginfo-2.79-13.el8_3.1',\n 'dnsmasq-debugsource-2.79-13.el8_3.1',\n 'dnsmasq-utils-2.79-13.el8_3.1',\n 'dnsmasq-utils-debuginfo-2.79-13.el8_3.1'\n ]\n};\npkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:'ZTE ' + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:01:47", "description": "This update for dnsmasq fixes the following issues :\n\n - bsc#1177077: Fixed DNSpooq vulnerabilities\n\n - CVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache Poisoning attacks.\n\n - CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed multiple potential Heap-based overflows when DNSSEC is enabled.\n\n - Retry query to other servers on receipt of SERVFAIL rcode (bsc#1176076)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.", "cvss3": {}, "published": "2021-01-25T00:00:00", "type": "nessus", "title": "openSUSE Security Update : dnsmasq (openSUSE-2021-124)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:dnsmasq", "p-cpe:/a:novell:opensuse:dnsmasq-debuginfo", "p-cpe:/a:novell:opensuse:dnsmasq-debugsource", "p-cpe:/a:novell:opensuse:dnsmasq-utils", "p-cpe:/a:novell:opensuse:dnsmasq-utils-debuginfo", "cpe:/o:novell:opensuse:15.2"], "id": "OPENSUSE-2021-124.NASL", "href": "https://www.tenable.com/plugins/nessus/145356", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2021-124.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145356);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"openSUSE Security Update : dnsmasq (openSUSE-2021-124)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote openSUSE host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for dnsmasq fixes the following issues :\n\n - bsc#1177077: Fixed DNSpooq vulnerabilities\n\n - CVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed\n multiple Cache Poisoning attacks.\n\n - CVE-2020-25681, CVE-2020-25682, CVE-2020-25683,\n CVE-2020-25687: Fixed multiple potential Heap-based\n overflows when DNSSEC is enabled.\n\n - Retry query to other servers on receipt of SERVFAIL\n rcode (bsc#1176076)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update\nproject.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1176076\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1177077\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dnsmasq-utils-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.2\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.2\", reference:\"dnsmasq-2.78-lp152.7.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"dnsmasq-debuginfo-2.78-lp152.7.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"dnsmasq-debugsource-2.78-lp152.7.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"dnsmasq-utils-2.78-lp152.7.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"dnsmasq-utils-debuginfo-2.78-lp152.7.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq / dnsmasq-debuginfo / dnsmasq-debugsource / dnsmasq-utils / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:04:41", "description": "According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-03-24T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP5 : dnsmasq (EulerOS-SA-2021-1673)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "p-cpe:/a:huawei:euleros:dnsmasq-utils", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2021-1673.NASL", "href": "https://www.tenable.com/plugins/nessus/148050", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(148050);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS 2.0 SP5 : dnsmasq (EulerOS-SA-2021-1673)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data.\n An attacker on the network, who can forge DNS replies\n such as that they are accepted as valid, could use this\n flaw to cause a buffer overflow with arbitrary data in\n a heap memory segment, possibly executing code on the\n machine. The highest threat from this vulnerability is\n to data confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer\n overflow vulnerability was discovered in the way\n dnsmasq extract names from DNS packets before\n validating them with DNSSEC data. An attacker on the\n network, who can create valid DNS replies, could use\n this flaw to cause an overflow with arbitrary data in a\n heap-allocated memory, possibly executing code on the\n machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by\n name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is\n possible extract_name() gets passed an offset from the\n base buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n get_rdata() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in the forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in forward.c:reply_query(), which is the forwarded\n query that matches the reply, by only using a weak hash\n of the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When\n receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards\n a new request. By default, a maximum of 150 pending\n queries can be sent to upstream servers, so there can\n be at most 150 queries for the same name. This flaw\n allows an off-path attacker on the network to\n substantially reduce the number of attempts that it\n would have to perform to forge a reply and have it\n accepted by dnsmasq. This issue is mentioned in the\n 'Birthday Attacks' section of RFC5452. If chained with\n CVE-2020-25684, the attack complexity of a successful\n attack is reduced. The highest threat from this\n vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A\n heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the\n received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an\n overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in\n rfc1035.c:extract_name(), which could be abused to make\n the code execute memcpy() with a negative size in\n sort_rrset() and cause a crash in dnsmasq, resulting in\n a denial of service. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-25687)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1673\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bded9d9e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(5)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.76-5.h7.eulerosv2r7\",\n \"dnsmasq-utils-2.76-5.h7.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"5\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:07:33", "description": "According to the versions of the dnsmasq package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-04-15T00:00:00", "type": "nessus", "title": "EulerOS Virtualization 2.9.1 : dnsmasq (EulerOS-SA-2021-1733)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "cpe:/o:huawei:euleros:uvp:2.9.1"], "id": "EULEROS_SA-2021-1733.NASL", "href": "https://www.tenable.com/plugins/nessus/148613", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(148613);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS Virtualization 2.9.1 : dnsmasq (EulerOS-SA-2021-1733)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq package installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. This flaw allows a remote attacker, who can\n create valid DNS replies, to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in sort_rrset() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When receiving a query,\n dnsmasq does not check for an existing pending request\n for the same name and forwards a new request. By\n default, a maximum of 150 pending queries can be sent\n to upstream servers, so there can be at most 150\n queries for the same name. This flaw allows an off-path\n attacker on the network to substantially reduce the\n number of attempts that it would have to perform to\n forge a reply and have it accepted by dnsmasq. This\n issue is mentioned in the 'Birthday Attacks' section of\n RFC5452. If chained with CVE-2020-25684, the attack\n complexity of a successful attack is reduced. The\n highest threat from this vulnerability is to data\n integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq. When getting a reply from\n a forwarded query, dnsmasq checks in\n forward.c:reply_query(), which is the forwarded query\n that matches the reply, by only using a weak hash of\n the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When getting a reply from\n a forwarded query, dnsmasq checks in the\n forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. A remote attacker, who can create valid DNS\n replies, could use this flaw to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in get_rdata() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. A buffer overflow\n vulnerability was discovered in the way dnsmasq extract\n names from DNS packets before validating them with\n DNSSEC data. An attacker on the network, who can create\n valid DNS replies, could use this flaw to cause an\n overflow with arbitrary data in a heap-allocated\n memory, possibly executing code on the machine. The\n flaw is in the rfc1035.c:extract_name() function, which\n writes data to the memory pointed by name assuming\n MAXDNAME*2 bytes are available in the buffer. However,\n in some code execution paths, it is possible\n extract_name() gets passed an offset from the base\n buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in the way RRSets are sorted\n before validating with DNSSEC data. An attacker on the\n network, who can forge DNS replies such as that they\n are accepted as valid, could use this flaw to cause a\n buffer overflow with arbitrary data in a heap memory\n segment, possibly executing code on the machine. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1733\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6a9a7d34\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/04/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/04/15\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:2.9.1\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"2.9.1\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 2.9.1\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.81-1.h6.eulerosv2r9\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:04:08", "description": "According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-03-10T00:00:00", "type": "nessus", "title": "EulerOS Virtualization 3.0.2.6 : dnsmasq (EulerOS-SA-2021-1411)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "p-cpe:/a:huawei:euleros:dnsmasq-utils", "cpe:/o:huawei:euleros:uvp:3.0.2.6"], "id": "EULEROS_SA-2021-1411.NASL", "href": "https://www.tenable.com/plugins/nessus/147462", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147462);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS Virtualization 3.0.2.6 : dnsmasq (EulerOS-SA-2021-1411)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in the way RRSets are sorted\n before validating with DNSSEC data. An attacker on the\n network, who can forge DNS replies such as that they\n are accepted as valid, could use this flaw to cause a\n buffer overflow with arbitrary data in a heap memory\n segment, possibly executing code on the machine. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq. A buffer overflow\n vulnerability was discovered in the way dnsmasq extract\n names from DNS packets before validating them with\n DNSSEC data. An attacker on the network, who can create\n valid DNS replies, could use this flaw to cause an\n overflow with arbitrary data in a heap-allocated\n memory, possibly executing code on the machine. The\n flaw is in the rfc1035.c:extract_name() function, which\n writes data to the memory pointed by name assuming\n MAXDNAME*2 bytes are available in the buffer. However,\n in some code execution paths, it is possible\n extract_name() gets passed an offset from the base\n buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. A remote attacker, who can create valid DNS\n replies, could use this flaw to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in get_rdata() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. When getting a reply from\n a forwarded query, dnsmasq checks in the\n forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. This flaw allows a remote attacker, who can\n create valid DNS replies, to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in sort_rrset() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When getting a reply from\n a forwarded query, dnsmasq checks in\n forward.c:reply_query(), which is the forwarded query\n that matches the reply, by only using a weak hash of\n the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When receiving a query,\n dnsmasq does not check for an existing pending request\n for the same name and forwards a new request. By\n default, a maximum of 150 pending queries can be sent\n to upstream servers, so there can be at most 150\n queries for the same name. This flaw allows an off-path\n attacker on the network to substantially reduce the\n number of attempts that it would have to perform to\n forge a reply and have it accepted by dnsmasq. This\n issue is mentioned in the 'Birthday Attacks' section of\n RFC5452. If chained with CVE-2020-25684, the attack\n complexity of a successful attack is reduced. The\n highest threat from this vulnerability is to data\n integrity.(CVE-2020-25686)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1411\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2728ad96\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.2.6\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.2.6\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.2.6\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.76-5.h7.eulerosv2r7\",\n \"dnsmasq-utils-2.76-5.h7.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:06:02", "description": "According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-03-10T00:00:00", "type": "nessus", "title": "EulerOS Virtualization 3.0.6.6 : dnsmasq (EulerOS-SA-2021-1469)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "p-cpe:/a:huawei:euleros:dnsmasq-utils", "cpe:/o:huawei:euleros:uvp:3.0.6.6"], "id": "EULEROS_SA-2021-1469.NASL", "href": "https://www.tenable.com/plugins/nessus/147517", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147517);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS Virtualization 3.0.6.6 : dnsmasq (EulerOS-SA-2021-1469)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in the way RRSets are sorted\n before validating with DNSSEC data. An attacker on the\n network, who can forge DNS replies such as that they\n are accepted as valid, could use this flaw to cause a\n buffer overflow with arbitrary data in a heap memory\n segment, possibly executing code on the machine. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\n - A flaw was found in dnsmasq. A buffer overflow\n vulnerability was discovered in the way dnsmasq extract\n names from DNS packets before validating them with\n DNSSEC data. An attacker on the network, who can create\n valid DNS replies, could use this flaw to cause an\n overflow with arbitrary data in a heap-allocated\n memory, possibly executing code on the machine. The\n flaw is in the rfc1035.c:extract_name() function, which\n writes data to the memory pointed by name assuming\n MAXDNAME*2 bytes are available in the buffer. However,\n in some code execution paths, it is possible\n extract_name() gets passed an offset from the base\n buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. A remote attacker, who can create valid DNS\n replies, could use this flaw to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in get_rdata() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. When getting a reply from\n a forwarded query, dnsmasq checks in the\n forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. This flaw allows a remote attacker, who can\n create valid DNS replies, to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in sort_rrset() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When getting a reply from\n a forwarded query, dnsmasq checks in\n forward.c:reply_query(), which is the forwarded query\n that matches the reply, by only using a weak hash of\n the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When receiving a query,\n dnsmasq does not check for an existing pending request\n for the same name and forwards a new request. By\n default, a maximum of 150 pending queries can be sent\n to upstream servers, so there can be at most 150\n queries for the same name. This flaw allows an off-path\n attacker on the network to substantially reduce the\n number of attempts that it would have to perform to\n forge a reply and have it accepted by dnsmasq. This\n issue is mentioned in the 'Birthday Attacks' section of\n RFC5452. If chained with CVE-2020-25684, the attack\n complexity of a successful attack is reduced. The\n highest threat from this vulnerability is to data\n integrity.(CVE-2020-25686)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1469\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?4e587e6b\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.6.6\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.6.6\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.6.6\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.76-5.h7.eulerosv2r7\",\n \"dnsmasq-utils-2.76-5.h7.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:02:13", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0151 advisory.\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled (CVE-2020-25682)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled (CVE-2020-25683)\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled (CVE-2020-25687)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-19T00:00:00", "type": "nessus", "title": "RHEL 8 : dnsmasq (RHSA-2021:0151)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2023-05-24T00:00:00", "cpe": ["cpe:/o:redhat:rhel_aus:8.2", "cpe:/o:redhat:rhel_e4s:8.2", "cpe:/o:redhat:rhel_eus:8.2", "cpe:/o:redhat:rhel_tus:8.2", "p-cpe:/a:redhat:enterprise_linux:dnsmasq", "p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils"], "id": "REDHAT-RHSA-2021-0151.NASL", "href": "https://www.tenable.com/plugins/nessus/145077", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0151. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145077);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/24\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"RHSA\", value:\"2021:0151\");\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"RHEL 8 : dnsmasq (RHSA-2021:0151)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0151 advisory.\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled\n (CVE-2020-25682)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled\n (CVE-2020-25683)\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path\n attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled\n (CVE-2020-25687)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25681\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25682\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25683\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25684\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25685\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25687\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0151\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1881875\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1882014\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1882018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889688\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1890125\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1891568\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(122, 290, 326, 358);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '8.2')) audit(AUDIT_OS_NOT, 'Red Hat 8.2', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.2/x86_64/appstream/debug',\n 'content/aus/rhel8/8.2/x86_64/appstream/os',\n 'content/aus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.2/x86_64/baseos/debug',\n 'content/aus/rhel8/8.2/x86_64/baseos/os',\n 'content/aus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.2/ppc64le/sap/os',\n 'content/e4s/rhel8/8.2/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.2/x86_64/appstream/os',\n 'content/e4s/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.2/x86_64/baseos/os',\n 'content/e4s/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap/os',\n 'content/e4s/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/appstream/debug',\n 'content/eus/rhel8/8.2/aarch64/appstream/os',\n 'content/eus/rhel8/8.2/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/baseos/debug',\n 'content/eus/rhel8/8.2/aarch64/baseos/os',\n 'content/eus/rhel8/8.2/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.2/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.2/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.2/aarch64/highavailability/os',\n 'content/eus/rhel8/8.2/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.2/aarch64/supplementary/os',\n 'content/eus/rhel8/8.2/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.2/ppc64le/appstream/os',\n 'content/eus/rhel8/8.2/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.2/ppc64le/baseos/os',\n 'content/eus/rhel8/8.2/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/sap/debug',\n 'content/eus/rhel8/8.2/ppc64le/sap/os',\n 'content/eus/rhel8/8.2/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/appstream/debug',\n 'content/eus/rhel8/8.2/s390x/appstream/os',\n 'content/eus/rhel8/8.2/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/baseos/debug',\n 'content/eus/rhel8/8.2/s390x/baseos/os',\n 'content/eus/rhel8/8.2/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.2/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.2/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/highavailability/debug',\n 'content/eus/rhel8/8.2/s390x/highavailability/os',\n 'content/eus/rhel8/8.2/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.2/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.2/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/sap/debug',\n 'content/eus/rhel8/8.2/s390x/sap/os',\n 'content/eus/rhel8/8.2/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/supplementary/debug',\n 'content/eus/rhel8/8.2/s390x/supplementary/os',\n 'content/eus/rhel8/8.2/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/appstream/debug',\n 'content/eus/rhel8/8.2/x86_64/appstream/os',\n 'content/eus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/baseos/debug',\n 'content/eus/rhel8/8.2/x86_64/baseos/os',\n 'content/eus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.2/x86_64/highavailability/os',\n 'content/eus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap/debug',\n 'content/eus/rhel8/8.2/x86_64/sap/os',\n 'content/eus/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.2/x86_64/supplementary/os',\n 'content/eus/rhel8/8.2/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/appstream/debug',\n 'content/tus/rhel8/8.2/x86_64/appstream/os',\n 'content/tus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/baseos/debug',\n 'content/tus/rhel8/8.2/x86_64/baseos/os',\n 'content/tus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.2/x86_64/highavailability/os',\n 'content/tus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/nfv/debug',\n 'content/tus/rhel8/8.2/x86_64/nfv/os',\n 'content/tus/rhel8/8.2/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/rt/debug',\n 'content/tus/rhel8/8.2/x86_64/rt/os',\n 'content/tus/rhel8/8.2/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'dnsmasq-2.79-11.el8_2.2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.79-11.el8_2.2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Advanced Update Support, Extended Update Support, Telco Extended Update Support or Update Services for SAP Solutions repositories.\\n' +\n 'Access to these repositories requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:00:13", "description": "The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0150 advisory.\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled (CVE-2020-25682)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled (CVE-2020-25683)\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-29T00:00:00", "type": "nessus", "title": "CentOS 8 : dnsmasq (CESA-2021:0150)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:centos:centos:8", "p-cpe:/a:centos:centos:dnsmasq", "p-cpe:/a:centos:centos:dnsmasq-utils"], "id": "CENTOS8_RHSA-2021-0150.NASL", "href": "https://www.tenable.com/plugins/nessus/145698", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# Red Hat Security Advisory RHSA-2021:0150. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145698);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"RHSA\", value:\"2021:0150\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"CentOS 8 : dnsmasq (CESA-2021:0150)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2021:0150 advisory.\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled\n (CVE-2020-25682)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled\n (CVE-2020-25683)\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path\n attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled\n (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0150\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/29\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:dnsmasq-utils\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/CentOS/release');\nif (isnull(release) || 'CentOS' >!< release) audit(AUDIT_OS_NOT, 'CentOS');\nos_ver = pregmatch(pattern: \"CentOS(?: Stream)?(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nos_ver = os_ver[1];\nif ('CentOS Stream' >< release) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS Stream ' + os_ver);\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\npkgs = [\n {'reference':'dnsmasq-2.79-13.el8_3.1', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-2.79-13.el8_3.1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.79-13.el8_3.1', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.79-13.el8_3.1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'CentOS-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-29T14:55:31", "description": "This update for dnsmasq fixes the following issues :\n\nbsc#1177077: Fixed DNSpooq vulnerabilities\n\nCVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache Poisoning attacks.\n\nCVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed multiple potential Heap-based overflows when DNSSEC is enabled.\n\nRetry query to other servers on receipt of SERVFAIL rcode (bsc#1176076)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-01-20T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : dnsmasq (SUSE-SU-2021:0166-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:dnsmasq", "p-cpe:/a:novell:suse_linux:dnsmasq-debuginfo", "p-cpe:/a:novell:suse_linux:dnsmasq-debugsource", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2021-0166-1.NASL", "href": "https://www.tenable.com/plugins/nessus/145175", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2021:0166-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145175);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"SUSE SLES12 Security Update : dnsmasq (SUSE-SU-2021:0166-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for dnsmasq fixes the following issues :\n\nbsc#1177077: Fixed DNSpooq vulnerabilities\n\nCVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache\nPoisoning attacks.\n\nCVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed\nmultiple potential Heap-based overflows when DNSSEC is enabled.\n\nRetry query to other servers on receipt of SERVFAIL rcode\n(bsc#1176076)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1176076\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1177077\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25681/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25682/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25683/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25684/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25685/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25686/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25687/\");\n # https://www.suse.com/support/update/announcement/2021/suse-su-20210166-1\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6f7572f6\");\n script_set_attribute(attribute:\"solution\", value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud Crowbar 9 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2021-166=1\n\nSUSE OpenStack Cloud Crowbar 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2021-166=1\n\nSUSE OpenStack Cloud 9 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-9-2021-166=1\n\nSUSE OpenStack Cloud 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-8-2021-166=1\n\nSUSE OpenStack Cloud 7 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-7-2021-166=1\n\nSUSE Linux Enterprise Server for SAP 12-SP4 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP4-2021-166=1\n\nSUSE Linux Enterprise Server for SAP 12-SP3 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP3-2021-166=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP2-2021-166=1\n\nSUSE Linux Enterprise Server 12-SP5 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-166=1\n\nSUSE Linux Enterprise Server 12-SP4-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2021-166=1\n\nSUSE Linux Enterprise Server 12-SP3-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-2021-166=1\n\nSUSE Linux Enterprise Server 12-SP3-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2021-166=1\n\nSUSE Linux Enterprise Server 12-SP2-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-2021-166=1\n\nSUSE Linux Enterprise Server 12-SP2-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2021-166=1\n\nSUSE Enterprise Storage 5 :\n\nzypper in -t patch SUSE-Storage-5-2021-166=1\n\nHPE Helion Openstack 8 :\n\nzypper in -t patch HPE-Helion-OpenStack-8-2021-166=1\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2|3|4|5)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2/3/4/5\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"dnsmasq-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"dnsmasq-debuginfo-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"dnsmasq-debugsource-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"dnsmasq-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"dnsmasq-debuginfo-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"dnsmasq-debugsource-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"dnsmasq-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"dnsmasq-debuginfo-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"dnsmasq-debugsource-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"dnsmasq-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"dnsmasq-debuginfo-2.78-18.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"dnsmasq-debugsource-2.78-18.15.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:05:29", "description": "According to the versions of the dnsmasq packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-03-10T00:00:00", "type": "nessus", "title": "EulerOS Virtualization for ARM 64 3.0.2.0 : dnsmasq (EulerOS-SA-2021-1389)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "p-cpe:/a:huawei:euleros:dnsmasq-utils", "cpe:/o:huawei:euleros:uvp:3.0.2.0"], "id": "EULEROS_SA-2021-1389.NASL", "href": "https://www.tenable.com/plugins/nessus/147582", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147582);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS Virtualization for ARM 64 3.0.2.0 : dnsmasq (EulerOS-SA-2021-1389)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization for ARM 64 host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq packages installed, the\nEulerOS Virtualization for ARM 64 installation on the remote host is\naffected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. When\n receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards\n a new request. By default, a maximum of 150 pending\n queries can be sent to upstream servers, so there can\n be at most 150 queries for the same name. This flaw\n allows an off-path attacker on the network to\n substantially reduce the number of attempts that it\n would have to perform to forge a reply and have it\n accepted by dnsmasq. This issue is mentioned in the\n 'Birthday Attacks' section of RFC5452. If chained with\n CVE-2020-25684, the attack complexity of a successful\n attack is reduced. The highest threat from this\n vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in the forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in forward.c:reply_query(), which is the forwarded\n query that matches the reply, by only using a weak hash\n of the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. This flaw allows a remote attacker, who can\n create valid DNS replies, to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in sort_rrset() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. A remote attacker, who can create valid DNS\n replies, could use this flaw to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in get_rdata() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. A buffer overflow\n vulnerability was discovered in the way dnsmasq extract\n names from DNS packets before validating them with\n DNSSEC data. An attacker on the network, who can create\n valid DNS replies, could use this flaw to cause an\n overflow with arbitrary data in a heap-allocated\n memory, possibly executing code on the machine. The\n flaw is in the rfc1035.c:extract_name() function, which\n writes data to the memory pointed by name assuming\n MAXDNAME*2 bytes are available in the buffer. However,\n in some code execution paths, it is possible\n extract_name() gets passed an offset from the base\n buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in the way RRSets are sorted\n before validating with DNSSEC data. An attacker on the\n network, who can forge DNS replies such as that they\n are accepted as valid, could use this flaw to cause a\n buffer overflow with arbitrary data in a heap memory\n segment, possibly executing code on the machine. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1389\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0bd5d8af\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.2.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.2.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.76-5.h7\",\n \"dnsmasq-utils-2.76-5.h7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:00:15", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0150 advisory.\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled (CVE-2020-25682)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled (CVE-2020-25683)\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled (CVE-2020-25687)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-19T00:00:00", "type": "nessus", "title": "RHEL 8 : dnsmasq (RHSA-2021:0150)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2023-05-24T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.4", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.4", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.4", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.4", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:dnsmasq", "p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils"], "id": "REDHAT-RHSA-2021-0150.NASL", "href": "https://www.tenable.com/plugins/nessus/145088", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0150. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145088);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/24\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"RHSA\", value:\"2021:0150\");\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"RHEL 8 : dnsmasq (RHSA-2021:0150)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0150 advisory.\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled\n (CVE-2020-25682)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled\n (CVE-2020-25683)\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path\n attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled\n (CVE-2020-25687)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25681\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25682\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25683\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25684\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25685\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25687\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0150\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1881875\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1882014\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1882018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889688\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1890125\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1891568\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(122, 290, 326, 358);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.4/x86_64/appstream/debug',\n 'content/aus/rhel8/8.4/x86_64/appstream/os',\n 'content/aus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.4/x86_64/baseos/debug',\n 'content/aus/rhel8/8.4/x86_64/baseos/os',\n 'content/aus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/appstream/debug',\n 'content/e4s/rhel8/8.4/aarch64/appstream/os',\n 'content/e4s/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/aarch64/baseos/debug',\n 'content/e4s/rhel8/8.4/aarch64/baseos/os',\n 'content/e4s/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/appstream/debug',\n 'content/e4s/rhel8/8.4/s390x/appstream/os',\n 'content/e4s/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/s390x/baseos/debug',\n 'content/e4s/rhel8/8.4/s390x/baseos/os',\n 'content/e4s/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.4/x86_64/appstream/os',\n 'content/e4s/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.4/x86_64/baseos/os',\n 'content/e4s/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/nfv/debug',\n 'content/e4s/rhel8/8.4/x86_64/nfv/os',\n 'content/e4s/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap/os',\n 'content/e4s/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/appstream/debug',\n 'content/eus/rhel8/8.4/aarch64/appstream/os',\n 'content/eus/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/baseos/debug',\n 'content/eus/rhel8/8.4/aarch64/baseos/os',\n 'content/eus/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.4/aarch64/highavailability/os',\n 'content/eus/rhel8/8.4/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.4/aarch64/supplementary/os',\n 'content/eus/rhel8/8.4/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.4/ppc64le/appstream/os',\n 'content/eus/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.4/ppc64le/baseos/os',\n 'content/eus/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap/os',\n 'content/eus/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/appstream/debug',\n 'content/eus/rhel8/8.4/s390x/appstream/os',\n 'content/eus/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/baseos/debug',\n 'content/eus/rhel8/8.4/s390x/baseos/os',\n 'content/eus/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/highavailability/debug',\n 'content/eus/rhel8/8.4/s390x/highavailability/os',\n 'content/eus/rhel8/8.4/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/sap/debug',\n 'content/eus/rhel8/8.4/s390x/sap/os',\n 'content/eus/rhel8/8.4/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/supplementary/debug',\n 'content/eus/rhel8/8.4/s390x/supplementary/os',\n 'content/eus/rhel8/8.4/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/appstream/debug',\n 'content/eus/rhel8/8.4/x86_64/appstream/os',\n 'content/eus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/baseos/debug',\n 'content/eus/rhel8/8.4/x86_64/baseos/os',\n 'content/eus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.4/x86_64/highavailability/os',\n 'content/eus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap/debug',\n 'content/eus/rhel8/8.4/x86_64/sap/os',\n 'content/eus/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.4/x86_64/supplementary/os',\n 'content/eus/rhel8/8.4/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/appstream/debug',\n 'content/tus/rhel8/8.4/x86_64/appstream/os',\n 'content/tus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/baseos/debug',\n 'content/tus/rhel8/8.4/x86_64/baseos/os',\n 'content/tus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.4/x86_64/highavailability/os',\n 'content/tus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/nfv/debug',\n 'content/tus/rhel8/8.4/x86_64/nfv/os',\n 'content/tus/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/rt/debug',\n 'content/tus/rhel8/8.4/x86_64/rt/os',\n 'content/tus/rhel8/8.4/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'dnsmasq-2.79-13.el8_3.1', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.79-13.el8_3.1', 'sp':'4', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/appstream/debug',\n 'content/eus/rhel8/8.6/aarch64/appstream/os',\n 'content/eus/rhel8/8.6/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/baseos/debug',\n 'content/eus/rhel8/8.6/aarch64/baseos/os',\n 'content/eus/rhel8/8.6/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.6/aarch64/highavailability/os',\n 'content/eus/rhel8/8.6/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.6/aarch64/supplementary/os',\n 'content/eus/rhel8/8.6/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/appstream/debug',\n 'content/eus/rhel8/8.6/s390x/appstream/os',\n 'content/eus/rhel8/8.6/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/baseos/debug',\n 'content/eus/rhel8/8.6/s390x/baseos/os',\n 'content/eus/rhel8/8.6/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/highavailability/debug',\n 'content/eus/rhel8/8.6/s390x/highavailability/os',\n 'content/eus/rhel8/8.6/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/sap/debug',\n 'content/eus/rhel8/8.6/s390x/sap/os',\n 'content/eus/rhel8/8.6/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/supplementary/debug',\n 'content/eus/rhel8/8.6/s390x/supplementary/os',\n 'content/eus/rhel8/8.6/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'dnsmasq-2.79-13.el8_3.1', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.79-13.el8_3.1', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/aarch64/appstream/debug',\n 'content/dist/rhel8/8/aarch64/appstream/os',\n 'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/baseos/debug',\n 'content/dist/rhel8/8/aarch64/baseos/os',\n 'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/codeready-builder/debug',\n 'content/dist/rhel8/8/aarch64/codeready-builder/os',\n 'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/highavailability/debug',\n 'content/dist/rhel8/8/aarch64/highavailability/os',\n 'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/supplementary/debug',\n 'content/dist/rhel8/8/aarch64/supplementary/os',\n 'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/s390x/appstream/debug',\n 'content/dist/rhel8/8/s390x/appstream/os',\n 'content/dist/rhel8/8/s390x/appstream/source/SRPMS',\n 'content/dist/rhel8/8/s390x/baseos/debug',\n 'content/dist/rhel8/8/s390x/baseos/os',\n 'content/dist/rhel8/8/s390x/baseos/source/SRPMS',\n 'content/dist/rhel8/8/s390x/codeready-builder/debug',\n 'content/dist/rhel8/8/s390x/codeready-builder/os',\n 'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/s390x/highavailability/debug',\n 'content/dist/rhel8/8/s390x/highavailability/os',\n 'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/s390x/resilientstorage/debug',\n 'content/dist/rhel8/8/s390x/resilientstorage/os',\n 'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/s390x/sap/debug',\n 'content/dist/rhel8/8/s390x/sap/os',\n 'content/dist/rhel8/8/s390x/sap/source/SRPMS',\n 'content/dist/rhel8/8/s390x/supplementary/debug',\n 'content/dist/rhel8/8/s390x/supplementary/os',\n 'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'dnsmasq-2.79-13.el8_3.1', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.79-13.el8_3.1', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp']) && !enterprise_linux_flag) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-29T14:55:38", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0152 advisory.\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled (CVE-2020-25682)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled (CVE-2020-25683)\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled (CVE-2020-25687)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-19T00:00:00", "type": "nessus", "title": "RHEL 8 : dnsmasq (RHSA-2021:0152)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2023-05-24T00:00:00", "cpe": ["cpe:/o:redhat:rhel_e4s:8.1", "cpe:/o:redhat:rhel_eus:8.1", "p-cpe:/a:redhat:enterprise_linux:dnsmasq", "p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils"], "id": "REDHAT-RHSA-2021-0152.NASL", "href": "https://www.tenable.com/plugins/nessus/145082", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0152. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145082);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/24\");\n\n script_cve_id(\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"RHSA\", value:\"2021:0152\");\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"RHEL 8 : dnsmasq (RHSA-2021:0152)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0152 advisory.\n\n - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)\n\n - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled\n (CVE-2020-25682)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled\n (CVE-2020-25683)\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path\n attacker (CVE-2020-25686)\n\n - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled\n (CVE-2020-25687)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25681\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25682\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25683\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25684\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25685\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25687\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0152\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1881875\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1882014\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1882018\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889688\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1890125\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1891568\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(122, 290, 326, 358);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '8.1')) audit(AUDIT_OS_NOT, 'Red Hat 8.1', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/e4s/rhel8/8.1/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.1/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.1/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.1/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.1/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.1/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.1/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.1/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.1/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.1/ppc64le/sap/os',\n 'content/e4s/rhel8/8.1/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.1/x86_64/appstream/os',\n 'content/e4s/rhel8/8.1/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.1/x86_64/baseos/os',\n 'content/e4s/rhel8/8.1/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.1/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.1/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.1/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.1/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/sap/debug',\n 'content/e4s/rhel8/8.1/x86_64/sap/os',\n 'content/e4s/rhel8/8.1/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/appstream/debug',\n 'content/eus/rhel8/8.1/aarch64/appstream/os',\n 'content/eus/rhel8/8.1/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/baseos/debug',\n 'content/eus/rhel8/8.1/aarch64/baseos/os',\n 'content/eus/rhel8/8.1/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.1/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.1/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.1/aarch64/highavailability/os',\n 'content/eus/rhel8/8.1/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.1/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.1/aarch64/supplementary/os',\n 'content/eus/rhel8/8.1/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.1/ppc64le/appstream/os',\n 'content/eus/rhel8/8.1/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.1/ppc64le/baseos/os',\n 'content/eus/rhel8/8.1/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.1/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.1/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.1/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.1/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.1/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.1/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.1/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.1/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/sap/debug',\n 'content/eus/rhel8/8.1/ppc64le/sap/os',\n 'content/eus/rhel8/8.1/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.1/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.1/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.1/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/appstream/debug',\n 'content/eus/rhel8/8.1/s390x/appstream/os',\n 'content/eus/rhel8/8.1/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/baseos/debug',\n 'content/eus/rhel8/8.1/s390x/baseos/os',\n 'content/eus/rhel8/8.1/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.1/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.1/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/highavailability/debug',\n 'content/eus/rhel8/8.1/s390x/highavailability/os',\n 'content/eus/rhel8/8.1/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.1/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.1/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/sap/debug',\n 'content/eus/rhel8/8.1/s390x/sap/os',\n 'content/eus/rhel8/8.1/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.1/s390x/supplementary/debug',\n 'content/eus/rhel8/8.1/s390x/supplementary/os',\n 'content/eus/rhel8/8.1/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/appstream/debug',\n 'content/eus/rhel8/8.1/x86_64/appstream/os',\n 'content/eus/rhel8/8.1/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/baseos/debug',\n 'content/eus/rhel8/8.1/x86_64/baseos/os',\n 'content/eus/rhel8/8.1/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.1/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.1/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.1/x86_64/highavailability/os',\n 'content/eus/rhel8/8.1/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.1/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.1/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.1/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.1/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/sap/debug',\n 'content/eus/rhel8/8.1/x86_64/sap/os',\n 'content/eus/rhel8/8.1/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.1/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.1/x86_64/supplementary/os',\n 'content/eus/rhel8/8.1/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'dnsmasq-2.79-6.el8_1.1', 'sp':'1', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.79-6.el8_1.1', 'sp':'1', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Extended Update Support or Update Services for SAP Solutions repositories.\\n' +\n 'Access to these repositories requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:11:57", "description": "The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14603-1 advisory.\n\n - A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation.\n (CVE-2019-14834)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap- allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-06-10T00:00:00", "type": "nessus", "title": "SUSE SLES11 Security Update : dnsmasq (SUSE-SU-2021:14603-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-14834", "CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-06T00:00:00", "cpe": ["cpe:/o:novell:suse_linux:11", "p-cpe:/a:novell:suse_linux:dnsmasq"], "id": "SUSE_SU-2021-14603-1.NASL", "href": "https://www.tenable.com/plugins/nessus/150612", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2021:14603-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(150612);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/06\");\n\n script_cve_id(\n \"CVE-2019-14834\",\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2021:14603-1\");\n script_xref(name:\"IAVA\", value:\"2020-A-0194-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"SUSE SLES11 Security Update : dnsmasq (SUSE-SU-2021:14603-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in\nthe SUSE-SU-2021:14603-1 advisory.\n\n - A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to\n cause a denial of service (memory consumption) via vectors involving DHCP response creation.\n (CVE-2019-14834)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way\n RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS\n replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with\n arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from\n this vulnerability is to data confidentiality and integrity as well as system availability.\n (CVE-2020-25681)\n\n - A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq\n extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who\n can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-\n allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name()\n function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the\n buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from\n the base buffer, thus reducing, in practice, the number of available bytes that can be written in the\n buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as\n system availability. (CVE-2020-25682)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create\n valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25683)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in the forward.c:reply_query() if the reply destination address/port is used by the pending\n forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query,\n substantially reducing the number of attempts an attacker on the network would have to perform to forge a\n reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's\n attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful\n attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a\n weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1\n when it is) this flaw allows an off-path attacker to find several different domains all having the same\n hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the\n attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards a new request. By default, a maximum of 150\n pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that\n it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the\n Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a\n successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\n - A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq\n when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote\n attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is\n caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code\n execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial\n of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25687)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1154849\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1176076\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1177077\");\n # https://lists.suse.com/pipermail/sle-security-updates/2021-January/008224.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bb2f7f83\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-14834\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25681\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25682\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25683\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25684\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25685\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-25687\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/01/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/06/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES11', 'SUSE ' + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE ' + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP4\", os_ver + \" SP\" + sp);\n\npkgs = [\n {'reference':'dnsmasq-2.78-0.17.15', 'sp':'4', 'release':'SLES11', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'SLES_SAP-release-11.4'},\n {'reference':'dnsmasq-2.78-0.17.15', 'sp':'4', 'release':'SLES11', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'sles-release-11.4'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n exists_check = NULL;\n rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && release && exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n else if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n ltss_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in SUSE Enterprise Linux Server LTSS\\n' +\n 'repositories. Access to these package security updates require\\n' +\n 'a paid SUSE LTSS subscription.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + ltss_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:00:59", "description": "The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4698-1 advisory.\n\n - A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation.\n (CVE-2019-14834)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-19T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Dnsmasq vulnerabilities (USN-4698-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-14834", "CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2023-10-16T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:16.04:-:lts", "cpe:/o:canonical:ubuntu_linux:20.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:dnsmasq", "p-cpe:/a:canonical:ubuntu_linux:dnsmasq-base", "p-cpe:/a:canonical:ubuntu_linux:dnsmasq-utils", "p-cpe:/a:canonical:ubuntu_linux:dnsmasq-base-lua"], "id": "UBUNTU_USN-4698-1.NASL", "href": "https://www.tenable.com/plugins/nessus/145078", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4698-1. The text\n# itself is copyright (C) Canonical, Inc. See\n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered\n# trademark of Canonical, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145078);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/16\");\n\n script_cve_id(\n \"CVE-2019-14834\",\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"USN\", value:\"4698-1\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Dnsmasq vulnerabilities (USN-4698-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by multiple\nvulnerabilities as referenced in the USN-4698-1 advisory.\n\n - A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to\n cause a denial of service (memory consumption) via vectors involving DHCP response creation.\n (CVE-2019-14834)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4698-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25682\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/01/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:20.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dnsmasq-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dnsmasq-base-lua\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dnsmasq-utils\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2021-2023 Canonical, Inc. / NASL script (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('debian_package.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/Ubuntu/release');\nif ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nos_release = chomp(os_release);\nif (! ('16.04' >< os_release || '18.04' >< os_release || '20.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 16.04 / 18.04 / 20.04', 'Ubuntu ' + os_release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar pkgs = [\n {'osver': '16.04', 'pkgname': 'dnsmasq', 'pkgver': '2.75-1ubuntu0.16.04.7'},\n {'osver': '16.04', 'pkgname': 'dnsmasq-base', 'pkgver': '2.75-1ubuntu0.16.04.7'},\n {'osver': '16.04', 'pkgname': 'dnsmasq-utils', 'pkgver': '2.75-1ubuntu0.16.04.7'},\n {'osver': '18.04', 'pkgname': 'dnsmasq', 'pkgver': '2.79-1ubuntu0.2'},\n {'osver': '18.04', 'pkgname': 'dnsmasq-base', 'pkgver': '2.79-1ubuntu0.2'},\n {'osver': '18.04', 'pkgname': 'dnsmasq-base-lua', 'pkgver': '2.79-1ubuntu0.2'},\n {'osver': '18.04', 'pkgname': 'dnsmasq-utils', 'pkgver': '2.79-1ubuntu0.2'},\n {'osver': '20.04', 'pkgname': 'dnsmasq', 'pkgver': '2.80-1.1ubuntu1.2'},\n {'osver': '20.04', 'pkgname': 'dnsmasq-base', 'pkgver': '2.80-1.1ubuntu1.2'},\n {'osver': '20.04', 'pkgname': 'dnsmasq-base-lua', 'pkgver': '2.80-1.1ubuntu1.2'},\n {'osver': '20.04', 'pkgname': 'dnsmasq-utils', 'pkgver': '2.80-1.1ubuntu1.2'}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var osver = NULL;\n var pkgname = NULL;\n var pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-base / dnsmasq-base-lua / dnsmasq-utils');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:04:10", "description": "According to the versions of the dnsmasq packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in the default configuration of dnsmasq, as shipped with Fedora and Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled.\n Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.(CVE-2020-14312)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25681)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-03-04T00:00:00", "type": "nessus", "title": "EulerOS Virtualization for ARM 64 3.0.6.0 : dnsmasq (EulerOS-SA-2021-1551)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-14312", "CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686", "CVE-2020-25687"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/o:huawei:euleros:uvp:3.0.6.0", "p-cpe:/a:huawei:euleros:dnsmasq", "p-cpe:/a:huawei:euleros:dnsmasq-utils"], "id": "EULEROS_SA-2021-1551.NASL", "href": "https://www.tenable.com/plugins/nessus/147133", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147133);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\n \"CVE-2020-14312\",\n \"CVE-2020-25681\",\n \"CVE-2020-25682\",\n \"CVE-2020-25683\",\n \"CVE-2020-25684\",\n \"CVE-2020-25685\",\n \"CVE-2020-25686\",\n \"CVE-2020-25687\"\n );\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS Virtualization for ARM 64 3.0.6.0 : dnsmasq (EulerOS-SA-2021-1551)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization for ARM 64 host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq packages installed, the\nEulerOS Virtualization for ARM 64 installation on the remote host is\naffected by the following vulnerabilities :\n\n - A flaw was found in the default configuration of\n dnsmasq, as shipped with Fedora and Red Hat Enterprise\n Linux, where it listens on any interface and accepts\n queries from addresses outside of its local subnet. In\n particular, the option `local-service` is not enabled.\n Running dnsmasq in this manner may inadvertently make\n it an open resolver accessible from any address on the\n internet. This flaw allows an attacker to conduct a\n Distributed Denial of Service (DDoS) against other\n systems.(CVE-2020-14312)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. This flaw allows a remote attacker, who can\n create valid DNS replies, to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in sort_rrset() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25687)\n\n - A flaw was found in dnsmasq. When receiving a query,\n dnsmasq does not check for an existing pending request\n for the same name and forwards a new request. By\n default, a maximum of 150 pending queries can be sent\n to upstream servers, so there can be at most 150\n queries for the same name. This flaw allows an off-path\n attacker on the network to substantially reduce the\n number of attempts that it would have to perform to\n forge a reply and have it accepted by dnsmasq. This\n issue is mentioned in the 'Birthday Attacks' section of\n RFC5452. If chained with CVE-2020-25684, the attack\n complexity of a successful attack is reduced. The\n highest threat from this vulnerability is to data\n integrity.(CVE-2020-25686)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. A remote attacker, who can create valid DNS\n replies, could use this flaw to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in get_rdata() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq. When getting a reply from\n a forwarded query, dnsmasq checks in the\n forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in dnsmasq when DNSSEC is\n enabled and before it validates the received DNS\n entries. A remote attacker, who can create valid DNS\n replies, could use this flaw to cause an overflow in a\n heap-allocated memory. This flaw is caused by the lack\n of length checks in rfc1035.c:extract_name(), which\n could be abused to make the code execute memcpy() with\n a negative size in get_rdata() and cause a crash in\n dnsmasq, resulting in a denial of service. The highest\n threat from this vulnerability is to system\n availability.(CVE-2020-25683)\n\n - A flaw was found in dnsmasq. A buffer overflow\n vulnerability was discovered in the way dnsmasq extract\n names from DNS packets before validating them with\n DNSSEC data. An attacker on the network, who can create\n valid DNS replies, could use this flaw to cause an\n overflow with arbitrary data in a heap-allocated\n memory, possibly executing code on the machine. The\n flaw is in the rfc1035.c:extract_name() function, which\n writes data to the memory pointed by name assuming\n MAXDNAME*2 bytes are available in the buffer. However,\n in some code execution paths, it is possible\n extract_name() gets passed an offset from the base\n buffer, thus reducing, in practice, the number of\n available bytes that can be written in the buffer. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25682)\n\n - A flaw was found in dnsmasq. A heap-based buffer\n overflow was discovered in the way RRSets are sorted\n before validating with DNSSEC data. An attacker on the\n network, who can forge DNS replies such as that they\n are accepted as valid, could use this flaw to cause a\n buffer overflow with arbitrary data in a heap memory\n segment, possibly executing code on the machine. The\n highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25681)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1551\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?cc647336\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.6.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.6.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.6.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.79-7.h5.eulerosv2r8\",\n \"dnsmasq-utils-2.79-7.h5.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-27T15:04:09", "description": "Moshe Kol and Shlomi Oberman of JSOF discovered several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server. They could result in denial of service, cache poisoning or the execution of arbitrary code.\n\nFor Debian 9 stretch, these problems have been fixed in version 2.76-5+deb9u3.\n\nWe recommend that you upgrade your dnsmasq packages.\n\nFor the detailed security status of dnsmasq please refer to its security tracker page at:\nhttps://security-tracker.debian.org/tracker/dnsmasq\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-03-23T00:00:00", "type": "nessus", "title": "Debian DLA-2604-1 : dnsmasq security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25681", "CVE-2020-25682", "CVE-2020-25683", "CVE-2020-25684", "CVE-2020-25687"], "modified": "2022-12-06T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:dnsmasq", "p-cpe:/a:debian:debian_linux:dnsmasq-base", "p-cpe:/a:debian:debian_linux:dnsmasq-utils", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DLA-2604.NASL", "href": "https://www.tenable.com/plugins/nessus/147960", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-2604-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(147960);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/06\");\n\n script_cve_id(\"CVE-2020-25681\", \"CVE-2020-25682\", \"CVE-2020-25683\", \"CVE-2020-25684\", \"CVE-2020-25687\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Debian DLA-2604-1 : dnsmasq security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Moshe Kol and Shlomi Oberman of JSOF discovered several\nvulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP\nserver. They could result in denial of service, cache poisoning or the\nexecution of arbitrary code.\n\nFor Debian 9 stretch, these problems have been fixed in version\n2.76-5+deb9u3.\n\nWe recommend that you upgrade your dnsmasq packages.\n\nFor the detailed security status of dnsmasq please refer to its\nsecurity tracker page at:\nhttps://security-tracker.debian.org/tracker/dnsmasq\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2021/03/msg00027.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/dnsmasq\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/dnsmasq\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:dnsmasq-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"dnsmasq\", reference:\"2.76-5+deb9u3\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"dnsmasq-base\", reference:\"2.76-5+deb9u3\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"dnsmasq-utils\", reference:\"2.76-5+deb9u3\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-19T15:00:06", "description": "The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1587 advisory.\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-26T00:00:00", "type": "nessus", "title": "Amazon Linux 2 : dnsmasq (ALAS-2021-1587)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:dnsmasq", "p-cpe:/a:amazon:linux:dnsmasq-debuginfo", "p-cpe:/a:amazon:linux:dnsmasq-utils", "cpe:/o:amazon:linux:2"], "id": "AL2_ALAS-2021-1587.NASL", "href": "https://www.tenable.com/plugins/nessus/145454", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux 2 Security Advisory ALAS-2021-1587.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145454);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\");\n script_xref(name:\"ALAS\", value:\"2021-1587\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Amazon Linux 2 : dnsmasq (ALAS-2021-1587)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Amazon Linux 2 host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by multiple\nvulnerabilities as referenced in the ALAS2-2021-1587 advisory.\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in the forward.c:reply_query() if the reply destination address/port is used by the pending\n forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query,\n substantially reducing the number of attempts an attacker on the network would have to perform to forge a\n reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's\n attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful\n attack is reduced. The highest threat from this vulnerability is to data integrity. (CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq\n checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a\n weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1\n when it is) this flaw allows an off-path attacker to find several different domains all having the same\n hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the\n attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity. (CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards a new request. By default, a maximum of 150\n pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name.\n This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that\n it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the\n Birthday Attacks section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a\n successful attack is reduced. The highest threat from this vulnerability is to data integrity.\n (CVE-2020-25686)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/AL2/ALAS-2021-1587.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25684\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25685\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25686\");\n script_set_attribute(attribute:\"solution\", value:\n\"Run 'yum update dnsmasq' to update your system.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25686\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/26\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:dnsmasq-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux:2\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"2\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux 2\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\npkgs = [\n {'reference':'dnsmasq-2.76-16.amzn2.1.1', 'cpu':'aarch64', 'release':'AL2'},\n {'reference':'dnsmasq-2.76-16.amzn2.1.1', 'cpu':'i686', 'release':'AL2'},\n {'reference':'dnsmasq-2.76-16.amzn2.1.1', 'cpu':'x86_64', 'release':'AL2'},\n {'reference':'dnsmasq-debuginfo-2.76-16.amzn2.1.1', 'cpu':'aarch64', 'release':'AL2'},\n {'reference':'dnsmasq-debuginfo-2.76-16.amzn2.1.1', 'cpu':'i686', 'release':'AL2'},\n {'reference':'dnsmasq-debuginfo-2.76-16.amzn2.1.1', 'cpu':'x86_64', 'release':'AL2'},\n {'reference':'dnsmasq-utils-2.76-16.amzn2.1.1', 'cpu':'aarch64', 'release':'AL2'},\n {'reference':'dnsmasq-utils-2.76-16.amzn2.1.1', 'cpu':'i686', 'release':'AL2'},\n {'reference':'dnsmasq-utils-2.76-16.amzn2.1.1', 'cpu':'x86_64', 'release':'AL2'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq / dnsmasq-debuginfo / dnsmasq-utils\");\n}", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:23:09", "description": "The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0153 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-26T00:00:00", "type": "nessus", "title": "CentOS 7 : dnsmasq (CESA-2021:0153)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:centos:centos:dnsmasq", "p-cpe:/a:centos:centos:dnsmasq-utils", "cpe:/o:centos:centos:7"], "id": "CENTOS_RHSA-2021-0153.NASL", "href": "https://www.tenable.com/plugins/nessus/145439", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0153 and\n# CentOS Errata and Security Advisory 2021:0153 respectively.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145439);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\");\n script_xref(name:\"RHSA\", value:\"2021:0153\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"CentOS 7 : dnsmasq (CESA-2021:0153)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2021:0153 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path\n attacker (CVE-2020-25686)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n # https://lists.centos.org/pipermail/centos-announce/2021-January/048251.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?09cecf18\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/358.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25686\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_cwe_id(358);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/26\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/CentOS/release');\nif (isnull(release) || 'CentOS' >!< release) audit(AUDIT_OS_NOT, 'CentOS');\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'CentOS 7.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\npkgs = [\n {'reference':'dnsmasq-2.76-16.el7_9.1', 'sp':'9', 'cpu':'x86_64', 'release':'CentOS-7'},\n {'reference':'dnsmasq-utils-2.76-16.el7_9.1', 'sp':'9', 'cpu':'x86_64', 'release':'CentOS-7'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:23:47", "description": "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0240 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-25T00:00:00", "type": "nessus", "title": "RHEL 7 : dnsmasq (RHSA-2021:0240)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686"], "modified": "2023-01-23T00:00:00", "cpe": ["cpe:/o:redhat:rhel_aus:7.2", "p-cpe:/a:redhat:enterprise_linux:dnsmasq", "p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils"], "id": "REDHAT-RHSA-2021-0240.NASL", "href": "https://www.tenable.com/plugins/nessus/145403", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0240. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145403);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/23\");\n\n script_cve_id(\"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\");\n script_xref(name:\"RHSA\", value:\"2021:0240\");\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"RHEL 7 : dnsmasq (RHSA-2021:0240)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0240 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path\n attacker (CVE-2020-25686)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25684\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25685\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0240\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889688\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1890125\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25686\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(290, 326, 358);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:7.2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '7.2')) audit(AUDIT_OS_NOT, 'Red Hat 7.2', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel/server/7/7.2/x86_64/debug',\n 'content/aus/rhel/server/7/7.2/x86_64/optional/debug',\n 'content/aus/rhel/server/7/7.2/x86_64/optional/os',\n 'content/aus/rhel/server/7/7.2/x86_64/optional/source/SRPMS',\n 'content/aus/rhel/server/7/7.2/x86_64/os',\n 'content/aus/rhel/server/7/7.2/x86_64/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'dnsmasq-2.66-14.el7_2.3', 'sp':'2', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.66-14.el7_2.3', 'sp':'2', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Advanced Update Support repository.\\n' +\n 'Access to this repository requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:24:08", "description": "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0245 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-25T00:00:00", "type": "nessus", "title": "RHEL 7 : dnsmasq (RHSA-2021:0245)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686"], "modified": "2023-01-23T00:00:00", "cpe": ["cpe:/o:redhat:rhel_aus:7.3", "p-cpe:/a:redhat:enterprise_linux:dnsmasq", "p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils"], "id": "REDHAT-RHSA-2021-0245.NASL", "href": "https://www.tenable.com/plugins/nessus/145404", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0245. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145404);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/23\");\n\n script_cve_id(\"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\");\n script_xref(name:\"RHSA\", value:\"2021:0245\");\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"RHEL 7 : dnsmasq (RHSA-2021:0245)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0245 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path\n attacker (CVE-2020-25686)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25684\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25685\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0245\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889688\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1890125\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25686\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(290, 326, 358);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '7.3')) audit(AUDIT_OS_NOT, 'Red Hat 7.3', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel/server/7/7.3/x86_64/debug',\n 'content/aus/rhel/server/7/7.3/x86_64/optional/debug',\n 'content/aus/rhel/server/7/7.3/x86_64/optional/os',\n 'content/aus/rhel/server/7/7.3/x86_64/optional/source/SRPMS',\n 'content/aus/rhel/server/7/7.3/x86_64/os',\n 'content/aus/rhel/server/7/7.3/x86_64/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'dnsmasq-2.66-21.el7_3.3', 'sp':'3', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.66-21.el7_3.3', 'sp':'3', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Advanced Update Support repository.\\n' +\n 'Access to this repository requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:22:50", "description": "The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0153 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-19T00:00:00", "type": "nessus", "title": "Oracle Linux 7 : dnsmasq (ELSA-2021-0153)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686"], "modified": "2022-12-07T00:00:00", "cpe": ["cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:dnsmasq", "p-cpe:/a:oracle:linux:dnsmasq-utils"], "id": "ORACLELINUX_ELSA-2021-0153.NASL", "href": "https://www.tenable.com/plugins/nessus/145075", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2021-0153.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145075);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/07\");\n\n script_cve_id(\"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"Oracle Linux 7 : dnsmasq (ELSA-2021-0153)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2021-0153 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's\nself-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2021-0153.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25686\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:dnsmasq-utils\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\npkgs = [\n {'reference':'dnsmasq-2.76-16.el7_9.1', 'cpu':'x86_64', 'release':'7'},\n {'reference':'dnsmasq-utils-2.76-16.el7_9.1', 'cpu':'x86_64', 'release':'7'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n rpm_prefix = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['rpm_prefix'])) rpm_prefix = package_array['rpm_prefix'];\n if (reference && release) {\n if (rpm_prefix) {\n if (rpm_exists(release:release, rpm:rpm_prefix) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:31:54", "description": "According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the 'Birthday Attacks' section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.(CVE-2020-25686)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2021-07-06T00:00:00", "type": "nessus", "title": "EulerOS Virtualization 3.0.2.2 : dnsmasq (EulerOS-SA-2021-2134)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686"], "modified": "2022-12-05T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:dnsmasq", "p-cpe:/a:huawei:euleros:dnsmasq-utils", "cpe:/o:huawei:euleros:uvp:3.0.2.2"], "id": "EULEROS_SA-2021-2134.NASL", "href": "https://www.tenable.com/plugins/nessus/151408", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(151408);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"EulerOS Virtualization 3.0.2.2 : dnsmasq (EulerOS-SA-2021-2134)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the dnsmasq packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in the forward.c:reply_query() if the reply destination\n address/port is used by the pending forwarded queries.\n However, it does not use the address/port to retrieve\n the exact forwarded query, substantially reducing the\n number of attempts an attacker on the network would\n have to perform to forge a reply and get it accepted by\n dnsmasq. This issue contrasts with RFC5452, which\n specifies a query's attributes that all must be used to\n match a reply. This flaw allows an attacker to perform\n a DNS Cache Poisoning attack. If chained with\n CVE-2020-25685 or CVE-2020-25686, the attack complexity\n of a successful attack is reduced. The highest threat\n from this vulnerability is to data\n integrity.(CVE-2020-25684)\n\n - A flaw was found in dnsmasq before version 2.83. When\n getting a reply from a forwarded query, dnsmasq checks\n in forward.c:reply_query(), which is the forwarded\n query that matches the reply, by only using a weak hash\n of the query name. Due to the weak hash (CRC32 when\n dnsmasq is compiled without DNSSEC, SHA-1 when it is)\n this flaw allows an off-path attacker to find several\n different domains all having the same hash,\n substantially reducing the number of attempts they\n would have to perform to forge a reply and get it\n accepted by dnsmasq. This is in contrast with RFC5452,\n which specifies that the query name is one of the\n attributes of a query that must be used to match a\n reply. This flaw could be abused to perform a DNS Cache\n Poisoning attack. If chained with CVE-2020-25684 the\n attack complexity of a successful attack is reduced.\n The highest threat from this vulnerability is to data\n integrity.(CVE-2020-25685)\n\n - A flaw was found in dnsmasq before version 2.83. When\n receiving a query, dnsmasq does not check for an\n existing pending request for the same name and forwards\n a new request. By default, a maximum of 150 pending\n queries can be sent to upstream servers, so there can\n be at most 150 queries for the same name. This flaw\n allows an off-path attacker on the network to\n substantially reduce the number of attempts that it\n would have to perform to forge a reply and have it\n accepted by dnsmasq. This issue is mentioned in the\n 'Birthday Attacks' section of RFC5452. If chained with\n CVE-2020-25684, the attack complexity of a successful\n attack is reduced. The highest threat from this\n vulnerability is to data integrity.(CVE-2020-25686)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-2134\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?52557cee\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/07/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/07/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:dnsmasq-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.2.2\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.2.2\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.2.2\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"dnsmasq-2.76-5.h7.eulerosv2r7\",\n \"dnsmasq-utils-2.76-5.h7.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"dnsmasq\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-25T14:11:10", "description": "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0154 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-19T00:00:00", "type": "nessus", "title": "RHEL 7 : dnsmasq (RHSA-2021:0154)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686"], "modified": "2023-05-24T00:00:00", "cpe": ["cpe:/o:redhat:rhel_aus:7.7", "cpe:/o:redhat:rhel_e4s:7.7", "cpe:/o:redhat:rhel_eus:7.7", "cpe:/o:redhat:rhel_tus:7.7", "p-cpe:/a:redhat:enterprise_linux:dnsmasq", "p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils"], "id": "REDHAT-RHSA-2021-0154.NASL", "href": "https://www.tenable.com/plugins/nessus/145079", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0154. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145079);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/24\");\n\n script_cve_id(\"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\");\n script_xref(name:\"RHSA\", value:\"2021:0154\");\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"RHEL 7 : dnsmasq (RHSA-2021:0154)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0154 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker\n (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path\n attacker (CVE-2020-25686)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25684\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25685\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-25686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0154\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889686\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889688\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1890125\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected dnsmasq and / or dnsmasq-utils packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-25686\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(290, 326, 358);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:7.7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:7.7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:7.7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:7.7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '7.7')) audit(AUDIT_OS_NOT, 'Red Hat 7.7', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel/server/7/7.7/x86_64/debug',\n 'content/aus/rhel/server/7/7.7/x86_64/optional/debug',\n 'content/aus/rhel/server/7/7.7/x86_64/optional/os',\n 'content/aus/rhel/server/7/7.7/x86_64/optional/source/SRPMS',\n 'content/aus/rhel/server/7/7.7/x86_64/os',\n 'content/aus/rhel/server/7/7.7/x86_64/source/SRPMS',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/debug',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/highavailability/debug',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/highavailability/os',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/optional/debug',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/optional/os',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/optional/source/SRPMS',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/os',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/sap-hana/debug',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/sap-hana/os',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/sap-hana/source/SRPMS',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/sap/debug',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/sap/os',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel/power-le/7/7.7/ppc64le/source/SRPMS',\n 'content/e4s/rhel/server/7/7.7/x86_64/debug',\n 'content/e4s/rhel/server/7/7.7/x86_64/highavailability/debug',\n 'content/e4s/rhel/server/7/7.7/x86_64/highavailability/os',\n 'content/e4s/rhel/server/7/7.7/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel/server/7/7.7/x86_64/optional/debug',\n 'content/e4s/rhel/server/7/7.7/x86_64/optional/os',\n 'content/e4s/rhel/server/7/7.7/x86_64/optional/source/SRPMS',\n 'content/e4s/rhel/server/7/7.7/x86_64/os',\n 'content/e4s/rhel/server/7/7.7/x86_64/sap-hana/debug',\n 'content/e4s/rhel/server/7/7.7/x86_64/sap-hana/os',\n 'content/e4s/rhel/server/7/7.7/x86_64/sap-hana/source/SRPMS',\n 'content/e4s/rhel/server/7/7.7/x86_64/sap/debug',\n 'content/e4s/rhel/server/7/7.7/x86_64/sap/os',\n 'content/e4s/rhel/server/7/7.7/x86_64/sap/source/SRPMS',\n 'content/e4s/rhel/server/7/7.7/x86_64/source/SRPMS',\n 'content/eus/rhel/computenode/7/7.7/x86_64/debug',\n 'content/eus/rhel/computenode/7/7.7/x86_64/optional/debug',\n 'content/eus/rhel/computenode/7/7.7/x86_64/optional/os',\n 'content/eus/rhel/computenode/7/7.7/x86_64/optional/source/SRPMS',\n 'content/eus/rhel/computenode/7/7.7/x86_64/os',\n 'content/eus/rhel/computenode/7/7.7/x86_64/source/SRPMS',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/debug',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/highavailability/debug',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/highavailability/os',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/optional/debug',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/optional/os',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/optional/source/SRPMS',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/os',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/resilientstorage/debug',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/resilientstorage/os',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/sap-hana/debug',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/sap-hana/os',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/sap-hana/source/SRPMS',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/sap/debug',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/sap/os',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel/power-le/7/7.7/ppc64le/source/SRPMS',\n 'content/eus/rhel/power/7/7.7/ppc64/debug',\n 'content/eus/rhel/power/7/7.7/ppc64/optional/debug',\n 'content/eus/rhel/power/7/7.7/ppc64/optional/os',\n 'content/eus/rhel/power/7/7.7/ppc64/optional/source/SRPMS',\n 'content/eus/rhel/power/7/7.7/ppc64/os',\n 'content/eus/rhel/power/7/7.7/ppc64/sap/debug',\n 'content/eus/rhel/power/7/7.7/ppc64/sap/os',\n 'content/eus/rhel/power/7/7.7/ppc64/sap/source/SRPMS',\n 'content/eus/rhel/power/7/7.7/ppc64/source/SRPMS',\n 'content/eus/rhel/server/7/7.7/x86_64/debug',\n 'content/eus/rhel/server/7/7.7/x86_64/highavailability/debug',\n 'content/eus/rhel/server/7/7.7/x86_64/highavailability/os',\n 'content/eus/rhel/server/7/7.7/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel/server/7/7.7/x86_64/optional/debug',\n 'content/eus/rhel/server/7/7.7/x86_64/optional/os',\n 'content/eus/rhel/server/7/7.7/x86_64/optional/source/SRPMS',\n 'content/eus/rhel/server/7/7.7/x86_64/os',\n 'content/eus/rhel/server/7/7.7/x86_64/resilientstorage/debug',\n 'content/eus/rhel/server/7/7.7/x86_64/resilientstorage/os',\n 'content/eus/rhel/server/7/7.7/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel/server/7/7.7/x86_64/sap-hana/debug',\n 'content/eus/rhel/server/7/7.7/x86_64/sap-hana/os',\n 'content/eus/rhel/server/7/7.7/x86_64/sap-hana/source/SRPMS',\n 'content/eus/rhel/server/7/7.7/x86_64/sap/debug',\n 'content/eus/rhel/server/7/7.7/x86_64/sap/os',\n 'content/eus/rhel/server/7/7.7/x86_64/sap/source/SRPMS',\n 'content/eus/rhel/server/7/7.7/x86_64/source/SRPMS',\n 'content/eus/rhel/system-z/7/7.7/s390x/debug',\n 'content/eus/rhel/system-z/7/7.7/s390x/optional/debug',\n 'content/eus/rhel/system-z/7/7.7/s390x/optional/os',\n 'content/eus/rhel/system-z/7/7.7/s390x/optional/source/SRPMS',\n 'content/eus/rhel/system-z/7/7.7/s390x/os',\n 'content/eus/rhel/system-z/7/7.7/s390x/sap/debug',\n 'content/eus/rhel/system-z/7/7.7/s390x/sap/os',\n 'content/eus/rhel/system-z/7/7.7/s390x/sap/source/SRPMS',\n 'content/eus/rhel/system-z/7/7.7/s390x/source/SRPMS',\n 'content/tus/rhel/server/7/7.7/x86_64/debug',\n 'content/tus/rhel/server/7/7.7/x86_64/highavailability/debug',\n 'content/tus/rhel/server/7/7.7/x86_64/highavailability/os',\n 'content/tus/rhel/server/7/7.7/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel/server/7/7.7/x86_64/optional/debug',\n 'content/tus/rhel/server/7/7.7/x86_64/optional/os',\n 'content/tus/rhel/server/7/7.7/x86_64/optional/source/SRPMS',\n 'content/tus/rhel/server/7/7.7/x86_64/os',\n 'content/tus/rhel/server/7/7.7/x86_64/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'dnsmasq-2.76-10.el7_7.2', 'sp':'7', 'cpu':'ppc64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-2.76-10.el7_7.2', 'sp':'7', 'cpu':'ppc64le', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-2.76-10.el7_7.2', 'sp':'7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-2.76-10.el7_7.2', 'sp':'7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.76-10.el7_7.2', 'sp':'7', 'cpu':'ppc64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.76-10.el7_7.2', 'sp':'7', 'cpu':'ppc64le', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.76-10.el7_7.2', 'sp':'7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dnsmasq-utils-2.76-10.el7_7.2', 'sp':'7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Advanced Update Support, Extended Update Support, Telco Extended Update Support or Update Services for SAP Solutions repositories.\\n' +\n 'Access to these repositories requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dnsmasq / dnsmasq-utils');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-25T14:10:31", "description": "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0153 advisory.\n\n - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25684)\n\n - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker (CVE-2020-25685)\n\n - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker (CVE-2020-25686)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-19T00:00:00", "type": "nessus", "title": "RHEL 7 : dnsmasq (RHSA-2021:0153)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-25684", "CVE-2020-25685", "CVE-2020-25686"], "modified": "2023-05-24T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:dnsmasq", "p-cpe:/a:redhat:enterprise_linux:dnsmasq-utils"], "id": "REDHAT-RHSA-2021-0153.NASL", "href": "https://www.tenable.com/plugins/nessus/145087", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0153. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145087);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/24\");\n\n script_cve_id(\"CVE-2020-25684\", \"CVE-2020-25685\", \"CVE-2020-25686\");\n script_xref(name:\"RHSA\", value:\"2021:0153\");\n script_xref(name:\"IAVA\", value:\"2021-A-0041\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0003\");\n\n script_name(english:\"RHEL 7 : dnsmasq (RHSA-2021:0153)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 host has packages insta