PT-2017-3345 · Dnsmasq+5 · Dnsmasq+5

Felix Wilhelm + 4 · Publicado 2017-09-25 · Atualizado 2024-06-15 · CVE-2017-14494

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.78

Description The issue is related to deficiencies in handling forwarded DHCPv6 requests, which can be exploited by a remote attacker to disclose sensitive information by injecting special elements into a command. This can allow remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.

Recommendations For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 relay functionality until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2017-2387

BDU:2018-00110

CESA-2017_2836

CESA-2017_2838

CVE-2017-14494

DLA-1124-1

DSA-3989-1

ELSA-2017-2836

MGASA-2017-0364

MGASA-2017-0367

OPENSUSE-SU-2017_2633-1

OPENSUSE-SU-2024:10721-1

RHSA-2017:2836

RHSA-2017:2837

RHSA-2017_2836

RHSA-2017_2838

RHSA-2017_2840

SUSE-SU-2017:2616-1

SUSE-SU-2017:2617-1

SUSE-SU-2017:2618-1

SUSE-SU-2017:2619-1

USN-3430-1

USN-3430-2

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Dnsmasq

Referências · 96

• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14495.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14493.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14494.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14492.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14496.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14491.py · Exploit
• 🔥 https://github.com/pupiles/bof-dnsmasq-cve-2017-14493 · Exploit
• 🔥 https://exploit-db.com/exploits/42944 · Exploit
• http://ubuntu.com/usn/USN-3430-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-14494 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2021-3448 · Nota
• https://suse.com/security/cve/CVE-2017-14494 · Nota
• https://advisories.mageia.org/MGASA-2017-0367.html · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-14493 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-14492 · Aviso do Fabricante