Dnsmasq is a widely used lightweight network application tool designed to supply DNS (Domain Name System) forwarder, DHCP (Dynamic Host Configuration Protocol) server, router ads too network kick services for minor networks.
Dnsmasq comes pre-installed on diverse devices too operating systems, including Linux distributions such every bit Ubuntu too Debian, habitation routers, smartphones too Internet of Things (IoT) devices. Influenza A virus subtype H5N1 shodan scan for "Dnsmasq" reveals or therefore 1.1 1 chiliad m instances worldwide.
Recently, Google's safety squad reviewed Dnsmasq too discovered vii safety issues, including DNS-related remote code execution, information disclosure, too denial-of-service (DoS) issues that tin hold upwards triggered via DNS or DHCP.
"We discovered vii distinct issues (listed below) over the course of written report of our regular internal safety assessments," Google's safety squad wrote inwards a blog post published on Monday.
"Once nosotros determined the severity of these issues, nosotros worked to investigate their impact too exploitability too therefore produced internal proofs of concept for each of them. We also worked amongst the maintainer of Dnsmasq, Simon Kelley, to create appropriate patches too mitigate the issue."Since the vulnerabilities bring similar a shot been patched yesteryear Dnsmasq developer too maintainer Simon Kelley, Google researchers bring released details too proof-of-concept (PoC) exploit code for each of the vulnerabilities.
Out of vii vulnerabilities discovered yesteryear the team, 3 tin hold upwards exploited to perform remote code execution, 3 tin hold upwards used inwards denial of service attacks, too 1 information leakage flaw.
Here's the List of All Vulnerabilities:
- CVE-2017-14491—A DNS-based remote code execution vulnerability inwards Dnsmasq versions earlier 2.76 is marked every bit the well-nigh severe that allows for unrestricted heap overflows, affecting both conduct exposed too internal network setups.
- CVE-2017-14492—Another remote code execution vulnerability due to a DHCP-based heap overflow issue.
- CVE-2017-14493—Another noteworthy DHCP-based remote code execution põrnikas caused yesteryear a stack buffer overflow. According to Google, this flaw is piffling to exploit if it's used inwards conjunction amongst the flaw (CVE-2017-14494) mentioned below.
- CVE-2017-14494—An information leak inwards DHCP which tin hold upwards combined amongst CVE-2017-14493 to let attackers bypass ASLR safety machinery too execute arbitrary code on a target system.
- CVE-2017-14495—A flaw inwards Dnsmasq which tin hold upwards exploited to launch a denial of service (DoS) laid on yesteryear exhausting retention via DNS. The flaw impacts dnsmasq solely if 1 of these options is used: --add-mac, --add-cpe-id or --add-subnet.
- CVE-2017-14496—Google's Android operating organisation is specifically affected yesteryear this DoS final result which tin hold upwards exploited yesteryear a local hacker or 1 who is tethered conduct to the device. However, Google pointed out the service itself is sandboxed, therefore the opportunity to Android users is reduced.
- CVE-2017-14497—Another DoS final result wherein a large DNS enquiry tin crash the software.
Since all the issues bring already been addressed amongst the free of Dnsmasq 2.78, Dnsmasq users are advised to update their installations every bit presently every bit possible.
To spell your devices, brand certain to upgrade packages on your system. Google has updated its affected services too released the safety fixes to Android partners on v September 2017 inwards October's Android safety updates.
Other affected Google services are also claimed to hold upwards updated. Kubernetes versions 1.5.8, 1.6.11, 1.7.7, too 1.8.0 bring also been updated amongst a patched Dnsmasq.
