CVE-2020-25685
Summary
| CVE | CVE-2020-25685 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-01-20 16:15:00 UTC |
|---|
| Updated | 2023-11-07 03:20:00 UTC |
|---|
| Description | A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 33 Update: dnsmasq-2.83-1.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| Security Advisory 0061 - Arista |
MISC |
www.arista.com |
|
| [SECURITY] Fedora 32 Update: dnsmasq-2.84-1.fc32 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| [SECURITY] Fedora 33 Update: dnsmasq-2.83-1.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 32 Update: dnsmasq-2.84-1.fc32 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Dnsmasq: Multiple vulnerabilities (GLSA 202101-17) — Gentoo security |
GENTOO |
security.gentoo.org |
Third Party Advisory |
| DNSPOOQ - JSOF |
MISC |
www.jsof-tech.com |
Third Party Advisory |
| 1889688 – (CVE-2020-25685) CVE-2020-25685 dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker |
MISC |
bugzilla.redhat.com |
Issue Tracking, Patch, Third Party Advisory |
| Debian -- Security Information -- DSA-4844-1 dnsmasq |
DEBIAN |
www.debian.org |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296069 Oracle Solaris 11.4 Support Repository Update (SRU) 31.88.5 Missing (CPUJAN2021)
- 352293 Amazon Linux Security Update for dnsmasq: AL2012-2021-334
- 377140 Alibaba Cloud Linux Security Update for dnsmasq (ALINUX3-SA-2021:0009)
- 377442 Alibaba Cloud Linux Security Update for dnsmasq (ALINUX2-SA-2021:0002)
- 43821 Arista EOS Domain Name System (DNS) cache poisoning Vulnerability (SA0061)
- 500150 Alpine Linux Security Update for dnsmasq
- 503800 Alpine Linux Security Update for dnsmasq
- 670173 EulerOS Security Update for dnsmasq (EulerOS-SA-2021-1673)
- 670301 EulerOS Security Update for dnsmasq (EulerOS-SA-2021-1775)
- 690442 Free Berkeley Software Distribution (FreeBSD) Security Update for dnsmasq (5b5cf6e5-5b51-11eb-95ac-7f9491278677)
- 730121 McAfee Web Gateway Multiple Vulnerabilities (WP-3484,WP-3744,WP-3745,WP-3746,WP-3747,WP-3793,WP-3800)
- 750407 OpenSUSE Security Update for dnsmasq (openSUSE-SU-2021:0129-1)
- 750409 OpenSUSE Security Update for dnsmasq (openSUSE-SU-2021:0124-1)
- 900068 CBL-Mariner Linux Security Update for dnsmasq 2.79
- 903378 Common Base Linux Mariner (CBL-Mariner) Security Update for dnsmasq (3816)
- 940396 AlmaLinux Security Update for dnsmasq (ALSA-2021:0150)
