PT-2019-8988 · Qualcomm+1 · Qualcomm Snapdragon+1

Published 2019-07-25 · Updated 2019-08-05 · CVE-2018-13897

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660

Description The issue results in an information exposure due to the client's hostname being added to the DNS record on devices running dnsmasq. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, and Snapdragon Wearables.

Recommendations For Qualcomm Snapdragon versions MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, consider disabling the dnsmasq service as a temporary workaround until a patch is available. Restrict access to the DNS records to minimize the risk of exploitation. Avoid using the vulnerable dnsmasq configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-13897

Affected Products

Qualcomm Snapdragon

Dnsmasq

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-13897 · Security Note
• https://codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin · Patch
• https://t.me/cibsecurity/5715 · Telegram Post