Critical Vulnerability in dnsmasq: Potential for Off-Path Attack Exploitation
Summary
ALPINE-CVE-2020-25686: A flaw was found in dnsmasq before version 2.83. Affects dnsmasq versions < 2.83-r0. Fixed in 2.83-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dnsmasq is a lightweight DNS forwarder and DHCP server widely used in small networks. It provides essential services such as DNS caching and DHCP address assignment, making it a popular choice for home routers and small office networks. However, dnsmasq has been found to have a vulnerability that could allow attackers to exploit its handling of DNS queries.
Vulnerability Detail
A flaw was discovered in dnsmasq versions prior to 2.83, where the software fails to check for existing pending requests for the same DNS name when receiving a new query. This oversight allows an off-path attacker to send multiple queries for the same name, potentially overwhelming the system. By default, dnsmasq can handle a maximum of 150 pending queries, which means an attacker could significantly reduce the effort required to forge a DNS reply that dnsmasq would accept. This vulnerability is detailed in the 'Birthday Attacks' section of RFC5452 and poses a threat primarily to data integrity. If exploited in conjunction with CVE-2020-25684, the complexity of a successful attack is further diminished.
How To Fix
Minimum fixed version
2.83-r0
This is the first release that contains the fix.
sudo apk add --upgrade dnsmasqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the number of pending queries or implementing network segmentation to reduce exposure to potential attackers. However, the best solution is to apply the patch as soon as possible.
Conclusion
The vulnerability in dnsmasq poses a significant risk to data integrity due to its handling of DNS queries. It is crucial for users to update to the patched version 2.83-r0 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for dnsmasq →
FAQ
dnsmasq is a lightweight DNS forwarder and DHCP server that provides DNS caching and DHCP services for small networks.
All versions of dnsmasq prior to 2.83 are affected by this vulnerability.
The CVSS score of this vulnerability is 3.7, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing network segmentation or limiting the number of pending queries as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for dnsmasq.
