Lucene search

RedhatCVE-2020-25687

HistoryJan 20, 2021 - 5:15 p.m.

CVE-2020-25687

2021-01-2017:15:13

CWE-122

redhat

web.nvd.nist.gov

893

cve-2020-25687

dnsmasq

buffer overflow

dnssec

remote attacker

denial of service

nvd

vulnerability

heap-based

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

Confidence

High

EPSS

0.085

Percentile

94.5%

JSON

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Affected configurations

Nvd

Vulners

Node

thekelleysdnsmasqRange<2.83

Node

fedoraprojectfedoraMatch32

fedoraprojectfedoraMatch33

Node

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

VendorProductVersionCPE
dnsmasqdnsmasq*cpe:2.3:a:dnsmasq:dnsmasq:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dnsmasq	dnsmasq	*	cpe:2.3:a:dnsmasq:dnsmasq::::::::

CNA Affected

[
  {
    "product": "dnsmasq",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "dnsmasq 2.83"
      }
    ]
  }
]