CVE-2018-13897: Infoleak
First published: Thu Jul 25 2019(Updated: )
Clients hostname gets added to DNS record on device which is running dnsmasq resulting in an information exposure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660
Credit: product-security@qualcomm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Qualcomm Mdm9206 Firmware | ||
| Qualcomm Mdm9206 | ||
| Qualcomm Mdm9607 Firmware | ||
| Qualcomm Mdm9607 | ||
| Qualcomm Mdm9640 Firmware | ||
| Qualcomm Mdm9640 | ||
| Qualcomm Mdm9650 Firmware | ||
| Qualcomm Mdm9650 | ||
| Qualcomm Msm8909w Firmware | ||
| Qualcomm Msm8909w | ||
| Qualcomm Msm8996au Firmware | ||
| Qualcomm Msm8996au | ||
| Qualcomm Qcs605 Firmware | ||
| Qualcomm Qcs605 | ||
| Qualcomm Sd 210 Firmware | ||
| Qualcomm Sd 210 | ||
| Qualcomm Sd 212 Firmware | ||
| Qualcomm Sd 212 | ||
| Qualcomm Sd 205 Firmware | ||
| Qualcomm Sd 205 | ||
| Qualcomm Sd 615 Firmware | ||
| Qualcomm Sd 615 | ||
| Qualcomm Sd 616 Firmware | ||
| Qualcomm Sd 616 | ||
| Qualcomm Sd 415 Firmware | ||
| Qualcomm Sd 415 | ||
| Qualcomm Sd 625 Firmware | ||
| Qualcomm Sd 625 | ||
| Qualcomm Sd 636 Firmware | ||
| Qualcomm Sd 636 | ||
| Qualcomm Sd 650 Firmware | ||
| Qualcomm Sd 650 | ||
| Qualcomm Sd 652 Firmware | ||
| Qualcomm Sd 652 | ||
| Qualcomm Sd 675 Firmware | ||
| Qualcomm Sd 675 | ||
| Qualcomm Sd 712 Firmware | ||
| Qualcomm Sd 712 | ||
| Qualcomm Sd 710 Firmware | ||
| Qualcomm Sd 710 | ||
| Qualcomm Sd 670 Firmware | ||
| Qualcomm Sd 670 | ||
| Qualcomm Sd 730 Firmware | ||
| Qualcomm Sd 730 | ||
| Qualcomm Sd 820 Firmware | ||
| Qualcomm Sd 820 | ||
| Qualcomm Sd 820a Firmware | ||
| Qualcomm Sd 820a | ||
| Qualcomm Sd 835 Firmware | ||
| Qualcomm Sd 835 | ||
| Qualcomm Sd 855 Firmware | ||
| Qualcomm Sd 855 | ||
| Qualcomm Sda660 Firmware | ||
| Qualcomm Sda660 | ||
| Qualcomm Sdm630 Firmware | ||
| Qualcomm Sdm630 | ||
| Qualcomm Sdm660 Firmware | ||
| Qualcomm Sdm660 |
Remedy
https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-13897?
CVE-2018-13897 is a vulnerability that allows clients' hostname to be added to a DNS record on a device running dnsmasq, resulting in an information exposure in various Qualcomm products.
Which products are affected by CVE-2018-13897?
Qualcomm Mdm9206 Firmware, Qualcomm Mdm9640 Firmware, Qualcomm Mdm9650 Firmware, Qualcomm Qcs605 Firmware, Qualcomm Sd 210 Firmware, Qualcomm Sd 212 Firmware, Qualcomm Sd 205 Firmware, Qualcomm Sd 616 Firmware, Qualcomm Sd 415 Firmware, Qualcomm Sd 625 Firmware, Qualcomm Sd 636 Firmware, Qualcomm Sd 712 Firmware, Qualcomm Sd 710 Firmware, Qualcomm Sd 670 Firmware, Qualcomm Sd 730 Firmware, Qualcomm Sd 820a Firmware, Qualcomm Sd 835 Firmware, Qualcomm Sd 855 Firmware, Qualcomm Sdm630 Firmware, Qualcomm Sdm660 Firmware.
What is the severity of CVE-2018-13897?
The severity of CVE-2018-13897 is high with a CVSS score of 7.5.
How does CVE-2018-13897 work?
CVE-2018-13897 allows an attacker to exploit the dnsmasq vulnerability and add clients' hostname to a DNS record, leading to an information exposure.
Is there a fix available for CVE-2018-13897?
To fix CVE-2018-13897, users should update their devices with the latest firmware or software patches provided by Qualcomm.
- agent/type
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/qualcomm
- canonical/qualcomm mdm9206 firmware
- canonical/qualcomm mdm9206
- canonical/qualcomm mdm9607 firmware
- canonical/qualcomm mdm9607
- canonical/qualcomm mdm9640 firmware
- canonical/qualcomm mdm9640
- canonical/qualcomm mdm9650 firmware
- canonical/qualcomm mdm9650
- canonical/qualcomm msm8909w firmware
- canonical/qualcomm msm8909w
- canonical/qualcomm msm8996au firmware
- canonical/qualcomm msm8996au
- canonical/qualcomm qcs605 firmware
- canonical/qualcomm qcs605
- canonical/qualcomm sd 210 firmware
- canonical/qualcomm sd 210
- canonical/qualcomm sd 212 firmware
- canonical/qualcomm sd 212
- canonical/qualcomm sd 205 firmware
- canonical/qualcomm sd 205
- canonical/qualcomm sd 615 firmware
- canonical/qualcomm sd 615
- canonical/qualcomm sd 616 firmware
- canonical/qualcomm sd 616
- canonical/qualcomm sd 415 firmware
- canonical/qualcomm sd 415
- canonical/qualcomm sd 625 firmware
- canonical/qualcomm sd 625
- canonical/qualcomm sd 636 firmware
- canonical/qualcomm sd 636
- canonical/qualcomm sd 650 firmware
- canonical/qualcomm sd 650
- canonical/qualcomm sd 652 firmware
- canonical/qualcomm sd 652
- canonical/qualcomm sd 675 firmware
- canonical/qualcomm sd 675
- canonical/qualcomm sd 712 firmware
- canonical/qualcomm sd 712
- canonical/qualcomm sd 710 firmware
- canonical/qualcomm sd 710
- canonical/qualcomm sd 670 firmware
- canonical/qualcomm sd 670
- canonical/qualcomm sd 730 firmware
- canonical/qualcomm sd 730
- canonical/qualcomm sd 820 firmware
- canonical/qualcomm sd 820
- canonical/qualcomm sd 820a firmware
- canonical/qualcomm sd 820a
- canonical/qualcomm sd 835 firmware
- canonical/qualcomm sd 835
- canonical/qualcomm sd 855 firmware
- canonical/qualcomm sd 855
- canonical/qualcomm sda660 firmware
- canonical/qualcomm sda660
- canonical/qualcomm sdm630 firmware
- canonical/qualcomm sdm630
- canonical/qualcomm sdm660 firmware
- canonical/qualcomm sdm660