// For flags

CVE-2020-25685

dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker

Severity Score

3.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

Se encontró un fallo en dnsmasq versiones anteriores a 2.83. Al obtener una respuesta de una consulta reenviada, dnsmasq comprueba en forward.c:reply_query(), que es la consulta reenviada que coincide con la respuesta, usando solo un hash débil del nombre de la consulta. Debido al hash débil (CRC32 cuando dnsmasq se compila sin DNSSEC, SHA-1 cuando lo es), este fallo permite a un atacante fuera de ruta encontrar varios dominios diferentes que tengan el mismo hash, reduciendo sustancialmente el número de intentos que tendrían que realizar para falsificar una respuesta y conseguir que dnsmasq la acepte. Esto contrasta con RFC5452, que especifica que el nombre de la consulta es uno de los atributos de una consulta que debe ser usada para hacer coincidir una respuesta. Se puede abusar de este fallo para realizar un ataque de envenenamiento de caché de DNS. Si se encadena con CVE-2020-25684, se reduce la complejidad del ataque de un ataque con éxito

A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-09-16 CVE Reserved
  • 2021-01-19 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-11-09 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-326: Inadequate Encryption Strength
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Thekelleys
Search vendor "Thekelleys"
Dnsmasq
Search vendor "Thekelleys" for product "Dnsmasq"
< 2.83
Search vendor "Thekelleys" for product "Dnsmasq" and version " < 2.83"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
32
Search vendor "Fedoraproject" for product "Fedora" and version "32"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
33
Search vendor "Fedoraproject" for product "Fedora" and version "33"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
10.0
Search vendor "Debian" for product "Debian Linux" and version "10.0"
-
Affected
Arista
Search vendor "Arista"
Eos
Search vendor "Arista" for product "Eos"
>= 4.21 < 4.21.14m
Search vendor "Arista" for product "Eos" and version " >= 4.21 < 4.21.14m"
-
Affected
Arista
Search vendor "Arista"
Eos
Search vendor "Arista" for product "Eos"
>= 4.22 < 4.22.9m
Search vendor "Arista" for product "Eos" and version " >= 4.22 < 4.22.9m"
-
Affected
Arista
Search vendor "Arista"
Eos
Search vendor "Arista" for product "Eos"
>= 4.23 < 4.23.7m
Search vendor "Arista" for product "Eos" and version " >= 4.23 < 4.23.7m"
-
Affected
Arista
Search vendor "Arista"
Eos
Search vendor "Arista" for product "Eos"
>= 4.24 < 4.24.5m
Search vendor "Arista" for product "Eos" and version " >= 4.24 < 4.24.5m"
-
Affected
Arista
Search vendor "Arista"
Eos
Search vendor "Arista" for product "Eos"
>= 4.25 < 4.25.2f
Search vendor "Arista" for product "Eos" and version " >= 4.25 < 4.25.2f"
-
Affected