CVE-2020-25684: Medium severity dnsmasq vulnerability
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:replyquery() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
Other sources
When getting a reply from a forwarded query, dnsmasq checks in forward.c:replyquery() if the reply destination address/port is one of those used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies the attributes of a query that all must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2020-25684.
What is the severity level of CVE-2020-25684?
The severity level of CVE-2020-25684 is medium, with a severity value of 3.7.
What software versions are affected by CVE-2020-25684?
Dnsmasq versions up to and including 2.83 are affected by CVE-2020-25684. Fedora 32, Fedora 33, Debian Linux 9.0, Debian Linux 10.0, and Arista EOS versions ranging from 4.21 to 4.25 are also affected.
How can I fix CVE-2020-25684?
To fix CVE-2020-25684, update your Dnsmasq software to version 2.83 or later. If you are using Fedora, Debian, or Arista EOS, update to the respective patched versions.
Where can I find more information about CVE-2020-25684?
You can find more information about CVE-2020-25684 in the references provided: Bugzilla for Red Hat, Debian LTS announcement, and Fedora package-announce mailing list.