PT-2017-3345 · Dnsmasq+5 · Dnsmasq+5

Felix Wilhelm + 4 · Published 2017-09-25 · Updated 2024-06-15 · CVE-2017-14494

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.78

Description The issue is related to deficiencies in handling forwarded DHCPv6 requests, which can be exploited by a remote attacker to disclose sensitive information by injecting special elements into a command. This can allow remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.

Recommendations For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 relay functionality until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-2387

BDU:2018-00110

CESA-2017_2836

CESA-2017_2838

CVE-2017-14494

DLA-1124-1

DSA-3989-1

ELSA-2017-2836

MGASA-2017-0364

MGASA-2017-0367

OPENSUSE-SU-2017_2633-1

OPENSUSE-SU-2024:10721-1

RHSA-2017:2836

RHSA-2017:2837

RHSA-2017_2836

RHSA-2017_2838

RHSA-2017_2840

SUSE-SU-2017:2616-1

SUSE-SU-2017:2617-1

SUSE-SU-2017:2618-1

SUSE-SU-2017:2619-1

USN-3430-1

USN-3430-2

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Dnsmasq

References · 96

• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14495.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14493.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14494.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14492.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14496.py · Exploit
• 🔥 https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14491.py · Exploit
• 🔥 https://github.com/pupiles/bof-dnsmasq-cve-2017-14493 · Exploit
• 🔥 https://exploit-db.com/exploits/42944 · Exploit
• http://ubuntu.com/usn/USN-3430-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14494 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0367.html · Security Note
• https://ubuntu.com/security/CVE-2017-14493 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14492 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-14494 · Vendor Advisory
• http://thekelleys.org.uk/dnsmasq/CHANGELOG · Vendor Advisory