dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker

A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in forward.c:replyquery, which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is...

CVE-2020-25684

A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:replyquery if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially...

dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker

A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:replyquery if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially...

CVE-2020-25685

A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in forward.c:replyquery, which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is...

A Set of Severe Flaws Affect Popular DNSMasq DNS Forwarder

Cybersecurity researchers have uncovered multiple vulnerabilities in Dnsmasq, a popular open-source software used for caching Domain Name System DNS responses, thereby potentially allowing an adversary to mount DNS cache poisoning attacks and remotely execute malicious code. The seven flaws,...

CVE-2020-25684

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:replyquery if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query,...

dnsmasq < 2.83 Multiple Vulnerabilities (DNSPOOQ)

The version of dnsmasq installed on the remote host is prior to 2.83. It is, therefore, affected by multiple vulnerabilities: - Multiple remote buffer overflows in the DNSSEC implementation. CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687 - A UDP DNS cache poisoning vulnerability...

PT-2021-3537

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.83 Description A flaw in dnsmasq allows an off-path attacker to substantially reduce the number of attempts needed to forge a reply and have it accepted by dnsmasq. This issue is related to the lack of checking for...

PT-2021-3539

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.83 Description A flaw in dnsmasq allows an off-path attacker to forge a reply and get it accepted by dnsmasq due to the use of a weak hash CRC32 or SHA-1 when checking forwarded queries in the reply query function...

PT-2021-3540

Name of the Vulnerable Software and Affected Versions Dnsmasq affected versions not specified Arista EOS software affected versions not specified Description The issue is related to errors in the implementation of security checks for standard elements in the Dnsmasq DNS server's reply query...

Security Advisory 2021-01-19-1 - dnsmasq multiple vulnerabilities (CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25684, CVE-2020-25685, CVE-2020-25686, CVE-2020-25687)

DESCRIPTION Dnsmasq has two sets of vulnerabilities, one set of memory corruption issues handling DNSSEC and a second set of issues validating DNS responses. These vulnerabilities could allow an attacker to corrupt memory on the target device and perform cache poisoning attacks against the target...

CVE-2020-25685

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:replyquery, which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash CRC32 when dnsmasq is compiled without DNSSE...

CVE-2020-17470

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs they are always set to 1 in fnetdnspoll in fnetdns.c. This significantly simplifies DNS cache poisoning attacks...

CVE-2020-17439

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query wi...

CVE-2020-17439

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query wi...

Default configuration

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query wi...

Code injection

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs they are always set to 1 in fnetdnspoll in fnetdns.c. This significantly simplifies DNS cache poisoning attacks...

CVE-2020-17470

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs they are always set to 1 in fnetdnspoll in fnetdns.c. This significantly simplifies DNS cache poisoning attacks...

CVE-2020-17439

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query wi...

CVE-2020-17439

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query wi...