PT-2017-3005 · Dnsmasq+5 · Dnsmasq+5

Felix Wilhelm + 4 · Publicado 2017-09-25 · Atualizado 2024-06-15 · CVE-2017-14496

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.78

Description The issue is caused by an integer underflow in the add pseudoheader function of the Dnsmasq DNS server when the --add-mac, --add-cpe-id, or --add-subnet option is specified. This allows a remote attacker to cause a denial of service via a specially crafted DNS request.

Recommendations For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider disabling the add pseudoheader function or avoiding the use of the --add-mac, --add-cpe-id, or --add-subnet options until a patch is available.

Exploit

Correção

DoS

Integer Underflow

Enumeração de Fraquezas

CWE-191

Identificadores relacionados

ALT-PU-2017-2387

BDU:2017-02357

CESA-2017_2836

CESA-2017_2838

CVE-2017-14496

DSA-3989-1

ELSA-2017-2836

MGASA-2017-0364

MGASA-2017-0367

OPENSUSE-SU-2017_2633-1

OPENSUSE-SU-2024:10721-1

RHSA-2017:2836

RHSA-2017_2836

RHSA-2017_2838

RHSA-2017_2840

SUSE-SU-2017:2616-1

SUSE-SU-2017:2617-1

SUSE-SU-2017:2618-1

SUSE-SU-2017:2619-1

USN-3430-1

USN-3430-2

Produtos afetados

Alt Linux

Centos

Dnsmasq

Red Hat

Suse

Ubuntu

Referências · 98

• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14495.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14493.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14494.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14492.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14496.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14491.py · Exploit
• 🔥 https://github.com/pupiles/bof-dnsmasq-cve-2017-14493 · Exploit
• 🔥 https://exploit-db.com/exploits/42946 · Exploit
• https://security.alpinelinux.org/vuln/CVE-2017-14496 · Nota
• http://ubuntu.com/usn/USN-3430-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-14494 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2021-3448 · Nota
• https://suse.com/security/cve/CVE-2017-14494 · Nota
• https://advisories.mageia.org/MGASA-2017-0367.html · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-14492 · Aviso do Fabricante