CVE-2017-14491

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

In do_rfc1035_name of util.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when processing a malicious DNS server response with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2017-13704: Dnsmasq could be made to crash on a large DNS query. A DNS query received by UDP which exceeds 512 bytes (or the EDNS0 packet size, if different.) is enough to cause SIGSEGV.

CVE-2017-14491: A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code.

CVE-2017-14492: A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless.

CVE-2017-14493: A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code.

CVE-2017-14494: An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data.

CVE-2017-14495: A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet.

CVE-2017-14496: An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet.

An audit by mozilla security found several vulnerability and potential vulnerability in dnsmasq:

• Uninitialized buffer leads to memory leakage
• Allocated memory is not cleared
• Unchecked return value can lead to NULL pointer dereference
• Hardcoded values in fscanf() format strings with aliased buffers

CVE-2017-13704: Dnsmasq could be made to crash on a large DNS query: A DNS query received by UDP which exceeds 512 bytes (or the EDNS0 packet size, if different.) is enough to cause SIGSEGV. (bug 21793)

CVE-2017-14491: A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code.

CVE-2017-14492: A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless.

CVE-2017-14493: A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code.

CVE-2017-14494: An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data.

CVE-2017-14495: A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet.

CVE-2017-14496: An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet.

These are all security issues fixed in the dnsmasq-2.86-1.1 package on the GA media of openSUSE Tumbleweed.

This update for dnsmasq fixes the following issues.

Remedy the following security issues:

• CVE-2017-14491: 2 byte heap based overflow. [bsc#1060354]
• CVE-2017-14492: heap based overflow. [bsc#1060355]
• CVE-2017-14493: stack based overflow. [bsc#1060360]
• CVE-2017-14494: DHCP - info leak. [bsc#1060361]
• CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]
• CVE-2017-14496: DNS - DoS Integer underflow. [bsc#1060364]
• Prevent a man-in-the-middle attack (bsc#972164, fate#321175).

Furthermore, the following issues have been fixed:

• Fix DHCP relaying, broken in 2.76 and 2.77.
• Update to version 2.78 (fate#321175, fate#322030, bsc#1035227).
• Fix PXE booting for UEFI architectures (fate#322030).
• Drop PrivateDevices=yes which breaks logging (bsc#902511, bsc#904537)
• Build with support for DNSSEC (fate#318323, bsc#908137).

Please note that this update brings a (small) potential incompatibility in the handling of 'basename' in --pxe-service. Please read the CHANGELOG and the documentation if you are using this option.

This update for dnsmasq fixes the following security issues:

• CVE-2017-14491: 2 byte heap based overflow. [bsc#1060354]
• CVE-2017-14492: heap based overflow. [bsc#1060355]
• CVE-2017-14493: stack based overflow. [bsc#1060360]
• CVE-2017-14494: DHCP - info leak. [bsc#1060361]
• CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]
• CVE-2017-14496: DNS - DoS Integer underflow. [bsc#1060364]

This update brings a (small) potential incompatibility in the handling of 'basename' in --pxe-service. Please read the CHANGELOG and the documentation if you are using this option.

This update for dnsmasq fixes the following security issues:

• CVE-2017-14491: 2 byte heap based overflow. [bsc#1060354]
• CVE-2017-14492: heap based overflow. [bsc#1060355]
• CVE-2017-14493: stack based overflow. [bsc#1060360]
• CVE-2017-14494: DHCP - info leak. [bsc#1060361]
• CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]
• CVE-2017-14496: DNS - DoS Integer underflow. [bsc#1060364]

This update for dnsmasq fixes the following security issues:

• CVE-2017-14491: 2 byte heap based overflow. [bsc#1060354]
• CVE-2017-14492: heap based overflow. [bsc#1060355]
• CVE-2017-14493: stack based overflow. [bsc#1060360]
• CVE-2017-14494: DHCP - info leak. [bsc#1060361]
• CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]
• CVE-2017-14496: DNS - DoS Integer underflow. [bsc#1060364]

This update brings a (small) potential incompatibility in the handling of 'basename' in --pxe-service. Please read the CHANGELOG and the documentation if you are using this option.

Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly handled DNS requests. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-14491)

Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly handled IPv6 router advertisements. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-14492)

Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly handled DHCPv6 requests. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-14493)

Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly handled DHCPv6 packets. A remote attacker could use this issue to possibly obtain sensitive memory contents. (CVE-2017-14494)

Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly handled DNS requests. A remote attacker could use this issue to cause Dnsmasq to consume memory, resulting in a denial of service. (CVE-2017-14495)

Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly handled DNS requests. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service. (CVE-2017-14496)