A Set of Severe Flaws Affect Popular DNSMasq DNS Forwarder

guest · Jan 19, 2021

A Set of Severe Flaws Affect Popular DNSMasq DNS Forwarder
January 19, 2021
https://thehackernews.com/2021/01/a-set-of-severe-flaws-affect-popular.html

Cybersecurity researchers have uncovered multiple vulnerabilities in Dnsmasq, a popular open-source software used for caching Domain Name System (DNS) responses, thereby potentially allowing an adversary to mount DNS cache poisoning attacks and remotely execute malicious code.

The seven flaws, collectively called "DNSpooq" by Israeli research firm JSOF, echoes previously disclosed weaknesses in the DNS architecture, making Dnsmasq servers powerless against a range of attacks.

"We found that Dnsmasq is vulnerable to DNS cache poisoning attack by an off-path attacker (i.e., an attacker that does not observe the communication between the DNS forwarder and the DNS server)," the researchers noted in a report published today.
Click to expand...

Overview- DNSpooq

Vulnerabilities threaten DNS integrity (again)
The JSOF research labs are reporting 7 vulnerabilities found in dnsmasq, an open-source DNS forwarding software in common use. Dnsmasq is very popular, and we have identified approximately 40 vendors whom we believe use dnsmasq in their products, as well as major Linux distributions.
Mitigation and Workarounds
While several workarounds exist, and are documented in our technical whitepaper, the best and only full mitigation is to update dnsmasq to version 2.83 or above.
Click to expand...

Summary
DNSpooq is a series of vulnerabilities found in the ubiquitous open-source software dnsmasq, demonstrating that DNS is still insecure, 13 years after the last major attack was described.

Some of the DNSpooq vulnerabilities allow for DNS cache poisoning and one of the DNSpooq vulnerabilities could permit a potential Remote Code execution that could allow a takeover of many brands of home routers and other networking equipment, with millions of devices affected, and over a million instances directly exposed to the Internet.
Click to expand...

guest · Jan 20, 2021

Dnsmasq is vulnerable to memory corruption and cache poisoning
Vulnerability Note VU#434904
January 19, 2021
https://kb.cert.org/vuls/id/434904

Overview
Dnsmasq is vulnerable to a set of memory corruption issues handling DNSSEC data and a second set of issues validating DNS responses. These vulnerabilities could allow an attacker to corrupt memory on a vulnerable system and perform cache poisoning attacks against a vulnerable environment.
These vulnerabilities are also tracked as ICS-VU-668462 and referred to as DNSpooq.
Description
Dnsmasq is widely used open-source software that provides DNS forwarding and caching (and also a DHCP server). Dnsmasq is common in Internet-of-Things (IoT) and other embedded devices.
JSOF reported multiple memory corruption vulnerabilities in dnsmasq due to boundary checking errors in DNSSEC handling code. [...]
Click to expand...

Impact
The memory corruption vulnerabilities can be triggered by a remote attacker using crafted DNS responses that can lead to denial of service, information exposure, and potentially remote code execution. The DNS response validation vulnerabilities allow an attacker to use unsolicited DNS responses to poison the DNS cache and redirect users to arbitrary sites.
Click to expand...

guest · Jan 23, 2021

CERT/CC and CISA Report Multiple Vulnerabilities in Dnsmasq
January 21, 2021
https://us-cert.cisa.gov/ncas/curre...-cisa-report-multiple-vulnerabilities-dnsmasq

CISA and the CERT Coordination Center (CERT/CC) are aware of multiple vulnerabilities affecting Dnsmasq version 2.82 and prior. Dnsmasq is a widely-used, open-source software that provides Domain Name Service forwarding and caching and is common in Internet-of-Things (IoT) and other embedded devices. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

CISA encourages users and vendors of IoT and embedded devices that use Dnsmasq to review CERT/CC VU#434904 and CISA ICSA-21-019-01 21 for more information and to apply the necessary update. Refer to vendors for appropriate patches, when available.
Click to expand...

Log in or Sign up

A Set of Severe Flaws Affect Popular DNSMasq DNS Forwarder

guest Guest

guest Guest

guest Guest

Log in or Sign up

A Set of Severe Flaws Affect Popular DNSMasq DNS Forwarder

guest Guest

guest Guest

guest Guest

Useful Searches