7.5

CVE-2017-13704

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version17.04
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version7.1
Debian ≫ Debian Linux Version9.0
Fedoraproject ≫ Fedora Version27
Novell ≫ Leap Version42.2
Novell ≫ Leap Version42.3
Thekelleys ≫ Dnsmasq Version <= 2.77
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 65.41% 0.992
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://thekelleys.org.uk/dnsmasq/CHANGELOG
Vendor Advisory
Release Notes
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=63437ffbb58837b214b4b92cb1c54bc5f3279928
http://www.securityfocus.com/bid/101085
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/101977
http://www.securitytracker.com/id/1039474
Third Party Advisory
VDB Entry
https://access.redhat.com/security/vulnerabilities/3199382
Third Party Advisory
Issue Tracking
https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TK6DWC53WSU6633EVZL7H4PCWBYHMHK/
https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html
Third Party Advisory
https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html
https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html
https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq