In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.

An update of the dnsmasq package has been released.

According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An integer underflow flaw leading to a buffer over-read     was found in dnsmasq in the DNS code. An attacker could     send crafted DNS packets to dnsmasq which would cause     it to crash.i1/4^CVE-2017-13704i1/4%0

  - A vulnerability was found in Dnsmasq's implementation     of DNSSEC. Wildcard synthesized NSEC records could be     improperly interpreted to prove the non-existence of     hostnames that actually exist.i1/4^CVE-2017-15107i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.

Fixes CVE-2017-13704

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of dnsmasq installed on the remote host is prior to 2.78, and thus, is affected by the following vulnerabilities :

  - Denial of service related to handling DNS queries     exceeding 512 bytes. (CVE-2017-13704)

  - Heap overflow related to handling DNS requests. (CVE-2017-14491)

  - Heap overflow related to IPv6 router advertisement handling.
    (CVE-2017-14492)

  - Stack overflow related to DHCPv6 request handling.
    (CVE-2017-14493)

  - Memory disclosure related to DHCPv6 packet handling.
    (CVE-2017-14494)

  - Denial of service related to handling DNS queries.
    (CVE-2017-14495)

  - Denial of service related to handling DNS queries.
    (CVE-2017-14496)

Google Project Zero reports :

- CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this commit overflow was unrestricted.

- CVE-2017-14492: Heap based overflow.

- CVE-2017-14493: Stack Based overflow.

- CVE-2017-14494: Information Leak

- CVE-2017-14495: Lack of free()

- CVE-2017-14496: Invalid boundary checks. Integer underflow leading to a huge memcpy.

- CVE-2017-13704: Crash on large DNS query

New dnsmasq packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

ID	Name	Product	Family	Severity
202843	Photon OS 1.0: Dnsmasq PHSA-2017-0038	Nessus	PhotonOS Local Security Checks	high
123860	EulerOS Virtualization 2.5.3 : dnsmasq (EulerOS-SA-2019-1174)	Nessus	Huawei Local Security Checks	high
109037	pfSense < 2.3.5 Multiple Vulnerabilities (KRACK)	Nessus	Firewalls	critical
105837	Fedora 27 : dnsmasq (2017-274d763ed8)	Nessus	Fedora Local Security Checks	high
103647	dnsmasq < 2.78 Multiple Remote Vulnerabilities	Nessus	DNS	critical
103620	FreeBSD : dnsmasq -- multiple vulnerabilities (b77b5646-a778-11e7-ac58-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
103599	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : dnsmasq (SSA:2017-275-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2017-13704

high

Tenable Plugins

high

high

critical

high

critical

critical

critical