PT-2017-1001 · Simon Kelley+5 · Dnsmasq+5
Felix Wilhelm
+4
·
Published
2017-09-25
·
Updated
2026-03-10
·
CVE-2017-14491
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
dnsmasq versions prior to 2.78
Description
The issue is a heap-based buffer overflow that can be triggered by a crafted DNS response, allowing remote attackers to cause a denial of service or execute arbitrary code. This can occur due to a missing bounds check in the
do rfc1035 name function of util.c, potentially leading to an out of bounds write. The exploitation of this issue does not require user interaction and can result in remote code execution, denial of service, or an out of memory situation.Recommendations
For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting DNS response processing to minimize the risk of exploitation. Avoid using the
do rfc1035 name function in util.c until a patch is available.Exploit
Fix
DoS
Memory Corruption
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Dnsmasq