PT-2021-3537 · Dnsmasq+6 · Dnsmasq+6
Published
2021-01-19
·
Updated
2024-06-15
·
CVE-2020-25686
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
dnsmasq versions prior to 2.83
Description
A flaw in dnsmasq allows an off-path attacker to substantially reduce the number of attempts needed to forge a reply and have it accepted by dnsmasq. This issue is related to the lack of checking for existing pending requests for the same name, which can lead to DNS cache poisoning. The highest threat from this vulnerability is to data integrity. If chained with another issue, the attack complexity of a successful attack is reduced.
Recommendations
For dnsmasq versions prior to 2.83, update to version 2.83 or later to resolve the issue. As a temporary workaround, consider restricting the use of dnsmasq as a DNS server to minimize the risk of exploitation. Avoid using the EOS switch as a DNS server until the issue is resolved.
Exploit
Fix
Improperly Implemented Security Check for Standard
Authentication Bypass by Spoofing
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Linuxmint
Red Hat
Suse
Ubuntu
Dnsmasq