PT-2018-5766 · Dnsmasq+3 · Dnsmasq+3

Simon Kelley · Published 2018-01-19 · Updated 2024-06-15 · CVE-2017-15107

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Dnsmasq versions up to and including 2.78

Description: A vulnerability was found in the implementation of DNSSEC in Dnsmasq. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.

Recommendations: For versions up to and including 2.78, update to a version that includes a fix for this issue to prevent improper interpretation of wildcard synthesized NSEC records.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

ALT-PU-2018-1599

BDU:2026-01424

CVE-2017-15107

OPENSUSE-SU-2019:2669-1

OPENSUSE-SU-2019_2669-1

OPENSUSE-SU-2024:10721-1

SUSE-SU-2019:14190-1

SUSE-SU-2019:1721-1

SUSE-SU-2019:3188-1

SUSE-SU-2019:3189-1

SUSE-SU-2019_14190-1

SUSE-SU-2019_1721-1

SUSE-SU-2019_3188-1

SUSE-SU-2019_3189-1

USN-4924-1

Affected Products

Alt Linux

Dnsmasq

Suse

Ubuntu

References · 51

• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10721-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15107 · Security Note
• https://osv.dev/vulnerability/USN-4924-1 · Vendor Advisory
• http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/011896.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01424 · Security Note
• https://ubuntu.com/security/notices/USN-4924-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14513 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3189-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15107 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14190-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1721-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15107 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15107 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00027.html · Vendor Advisory