Critical Vulnerability in Dnsmasq: DNSSEC Wildcard Synthesis Issue
Summary
ALPINE-CVE-2017-15107: A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Affects dnsmasq versions < 2.79-r0. Fixed in 2.79-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dnsmasq is a lightweight DNS forwarder and DHCP server widely used in small networks. It provides DNS services to local devices and can cache DNS queries for improved performance. However, versions up to and including 2.78 are vulnerable to a flaw in the DNSSEC implementation, which can lead to incorrect hostname resolution.
Vulnerability Detail
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including version 2.78. The issue arises from the improper interpretation of wildcard synthesized NSEC records, which can falsely indicate that certain hostnames do not exist, despite their actual presence. This could lead to significant security risks, including the potential for man-in-the-middle attacks, as attackers could exploit this flaw to redirect traffic away from legitimate hosts.
How To Fix
Minimum fixed version
2.79-r0
This is the first release that contains the fix.
sudo apk add --upgrade dnsmasqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable DNSSEC validation in Dnsmasq by modifying the configuration file. Add the following line to your dnsmasq.conf: 'dnssec=off'. However, this is not a permanent solution and should only be used until the package can be updated.
Conclusion
The Dnsmasq vulnerability related to DNSSEC wildcard synthesis poses significant risks to network security. It is crucial to update to the patched version 2.79-r0 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for dnsmasq →
FAQ
Dnsmasq is a DNS forwarder and DHCP server that provides network services to local devices, improving DNS query performance through caching.
The vulnerability allows for the incorrect interpretation of DNSSEC records, potentially leading to the false assertion that valid hostnames do not exist.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for dnsmasq.
