CVE-2017-14491: Buffer Overflow
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
Other sources
In dorfc1035name of util.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when processing a malicious DNS server response with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Red Hat Product Security has been made aware of a heap-based buffer overflow affecting the DNS implementation of dnsmasq.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dnsmasqto a version that resolves this vulnerability.Fixed in 2.80-1+deb10u1Fixed in 2.85-1Fixed in 2.89-1 - Upgrade
Upgrade
redhat/dnsmasqto a version that resolves this vulnerability.Fixed in 2.78 - Upgrade
Upgrade
android/platform/external/dnsmasqto a version that resolves this vulnerability.Fixed in 8.1:2021-03-01 - Upgrade
Upgrade
android/platform/external/dnsmasqto a version that resolves this vulnerability.Fixed in 9:2021-03-01 - Upgrade
Upgrade
android/platform/external/dnsmasqto a version that resolves this vulnerability.Fixed in 10:2021-03-01 - Upgrade
Upgrade
android/platform/external/dnsmasqto a version that resolves this vulnerability.Fixed in 11:2021-03-01
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14491?
CVE-2017-14491 is classified as a high severity vulnerability due to its potential to cause denial of service or execute arbitrary code remotely.
How do I fix CVE-2017-14491?
To fix CVE-2017-14491, upgrade dnsmasq to version 2.80 or later on affected Debian systems, or to 2.78 for Red Hat systems.
What systems are affected by CVE-2017-14491?
CVE-2017-14491 affects multiple systems including Debian, Red Hat, and various Linux distributions using dnsmasq versions prior to 2.78.
What type of vulnerability is CVE-2017-14491?
CVE-2017-14491 is a heap-based buffer overflow vulnerability specifically within the DNS implementation of dnsmasq.
Can CVE-2017-14491 be exploited remotely?
Yes, CVE-2017-14491 can be exploited remotely via crafted DNS responses, making it a critical threat.