CVE-2020-25685
dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
Se encontró un fallo en dnsmasq versiones anteriores a 2.83. Al obtener una respuesta de una consulta reenviada, dnsmasq comprueba en forward.c:reply_query(), que es la consulta reenviada que coincide con la respuesta, usando solo un hash débil del nombre de la consulta. Debido al hash débil (CRC32 cuando dnsmasq se compila sin DNSSEC, SHA-1 cuando lo es), este fallo permite a un atacante fuera de ruta encontrar varios dominios diferentes que tengan el mismo hash, reduciendo sustancialmente el número de intentos que tendrían que realizar para falsificar una respuesta y conseguir que dnsmasq la acepte. Esto contrasta con RFC5452, que especifica que el nombre de la consulta es uno de los atributos de una consulta que debe ser usada para hacer coincidir una respuesta. Se puede abusar de este fallo para realizar un ataque de envenenamiento de caché de DNS. Si se encadena con CVE-2020-25684, se reduce la complejidad del ataque de un ataque con éxito
A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-09-16 CVE Reserved
- 2021-01-19 CVE Published
- 2024-08-04 CVE Updated
- 2024-11-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-326: Inadequate Encryption Strength
CAPEC
References (9)
URL | Tag | Source |
---|---|---|
https://www.arista.com/en/support/advisories-notices/security-advisories/12135-security-advisory-61 | Third Party Advisory | |
https://www.jsof-tech.com/disclosures/dnspooq | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=1889688 | 2021-02-03 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Thekelleys Search vendor "Thekelleys" | Dnsmasq Search vendor "Thekelleys" for product "Dnsmasq" | < 2.83 Search vendor "Thekelleys" for product "Dnsmasq" and version " < 2.83" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 32 Search vendor "Fedoraproject" for product "Fedora" and version "32" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
Arista Search vendor "Arista" | Eos Search vendor "Arista" for product "Eos" | >= 4.21 < 4.21.14m Search vendor "Arista" for product "Eos" and version " >= 4.21 < 4.21.14m" | - |
Affected
| ||||||
Arista Search vendor "Arista" | Eos Search vendor "Arista" for product "Eos" | >= 4.22 < 4.22.9m Search vendor "Arista" for product "Eos" and version " >= 4.22 < 4.22.9m" | - |
Affected
| ||||||
Arista Search vendor "Arista" | Eos Search vendor "Arista" for product "Eos" | >= 4.23 < 4.23.7m Search vendor "Arista" for product "Eos" and version " >= 4.23 < 4.23.7m" | - |
Affected
| ||||||
Arista Search vendor "Arista" | Eos Search vendor "Arista" for product "Eos" | >= 4.24 < 4.24.5m Search vendor "Arista" for product "Eos" and version " >= 4.24 < 4.24.5m" | - |
Affected
| ||||||
Arista Search vendor "Arista" | Eos Search vendor "Arista" for product "Eos" | >= 4.25 < 4.25.2f Search vendor "Arista" for product "Eos" and version " >= 4.25 < 4.25.2f" | - |
Affected
|