Vulnerability CVE-2020-25685

Vulnerability Name:

CVE-2020-25685 (CCN-195082)

Assigned:

2020-09-16

Published:

2021-01-19

Updated:

2022-12-08

Summary:

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

CVSS v3 Severity:

3.7 Low (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
3.2 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N)
3.5 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

4.0 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N)
3.5 Low (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-326

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2020-25685

Source: CCN
Type: US-CERT VU#434904
Dnsmasq is vulnerable to memory corruption and cache poisoning

Source: CCN
Type: dnsmasq Web site
dnsmasq

Source: secalert@redhat.com
Type: Issue Tracking, Patch, Third Party Advisory
secalert@redhat.com

Source: XF
Type: UNKNOWN
dnsmasq-cve202025685-cache-poisoning(195082)

Source: secalert@redhat.com
Type: Mailing List, Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Mailing List, Third Party Advisory
secalert@redhat.com

Source: CCN
Type: oss-sec Mailing List, Tue, 19 Jan 2021 13:30:49 +0100
Multiple CVEs in dnsmasq fixed in version 2.83

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: Cisco Security Advisory cisco-sa-dnsmasq-dns-2021-c5mrdf3g
Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021

Source: CCN
Type: ICSA-21-019-02
Dnsmasq by Simon Kelley

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: IBM Security Bulletin 6478161 (Security Privileged Identity Manager)
IBM Security Privileged Identity Manager is affected by security vulnerabilities (CVE-2020-25684, CVE-2020-25685, CVE-2020-25686)

Source: CCN
Type: JSOF web site
DNSpooq - Kaminsky attack is back!

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2020-25685

Vulnerable Configuration:

Configuration RedHat 1:

cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

Configuration RedHat 5:

cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

Configuration RedHat 6:

cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

Configuration RedHat 7:

cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

Configuration CCN 1:

cpe:/a:thekelleys:dnsmasq:2.80:*:*:*:*:*:*:*

OR cpe:/a:thekelleys:dnsmasq:2.82:*:*:*:*:*:*:*

OR cpe:/a:thekelleys:dnsmasq:2.81:*:*:*:*:*:*:*

AND

cpe:/a:ibm:security_privileged_identity_manager:2.1.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:7484	P	dnsmasq-2.86-150400.14.3 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:51564	P	Security update for kubevirt stack (Important)	2022-11-21
oval:org.opensuse.security:def:3233	P	libpng12-0-1.2.50-19.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3410	P	xscreensaver-5.22-7.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94539	P	dnsmasq-2.86-150400.14.3 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:94522	P	coreutils-8.32-150400.7.5 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2909	P	dnsmasq-2.86-150400.14.3 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:45	P	dnsmasq-2.78-7.6.1 on GA media (Moderate)	2022-06-13
oval:org.opensuse.security:def:95237	P	Security update for postgresql14 (Important)	2022-06-01
oval:org.opensuse.security:def:101950	P	Security update for the Linux Kernel (Live Patch 15 for SLE 15 SP3) (Important)	2022-03-30
oval:org.opensuse.security:def:974	P	Security update for openssl-1_1 (Important)	2022-03-16
oval:org.opensuse.security:def:112160	P	dnsmasq-2.86-1.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:105696	P	dnsmasq-2.86-1.1 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:62063	P	dnsmasq-2.78-7.6.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:100821	P	dnsmasq-2.78-7.6.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:71804	P	dnsmasq-2.78-7.6.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:101235	P	sane-backends-1.0.32-6.6.2 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:110649	P	Security update for dnsmasq (Important)	2021-01-20
oval:org.opensuse.security:def:111051	P	Security update for dnsmasq (Important)	2021-01-20
oval:org.opensuse.security:def:30003	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:58744	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:41275	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:51892	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:88120	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:73621	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:83210	P	Security update for dnsmasq (Important)	2021-01-19
oval:com.redhat.rhsa:def:20210150	P	RHSA-2021:0150: dnsmasq security update (Important)	2021-01-19
oval:org.opensuse.security:def:5400	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:90471	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:32921	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:23904	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:57000	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:97436	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:108616	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:45705	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:86088	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:10079	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:81075	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:66778	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:127104	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:31177	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:59476	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:21393	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:54738	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:88433	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:104126	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:75557	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:84144	P	Security update for dnsmasq (Important)	2021-01-19
oval:com.redhat.rhsa:def:20210153	P	RHSA-2021:0153: dnsmasq security update (Moderate)	2021-01-19
oval:org.opensuse.security:def:5689	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:91196	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:33653	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:64322	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:117416	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:28915	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:57447	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:98161	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:38127	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:51141	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:86560	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:82122	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:69465	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:31624	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:59734	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:23153	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:55189	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:89131	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:104851	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:75846	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:84602	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:96947	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:8580	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:33911	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:64499	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:125537	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:29366	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:57919	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:40127	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:87385	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:73444	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:82573	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:70219	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:32096	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:60259	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:23576	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:55826	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:89389	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:107901	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:44557	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:85641	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:96951	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:9325	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:34436	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:66489	P	Security update for dnsmasq (Important)	2021-01-19
oval:org.opensuse.security:def:126707	P	Security update for dnsmasq (Important)	2021-01-19

BACK