NetSight
IP …
medium5.9

CVE-2020-25687

A flaw was found in dnsmasq before version 2.83.

Impact

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Affected products

VendorProductAffected versions
ThekelleysDnsmasq
before 2.83
FedoraprojectFedora
Versions 32, 33
DebianDebian Linux
Versions 9.0, 10.0

Weakness classification

CWE-122

References