Strix
26.1K

CVE-2020-25685

LOWCVSS 3.7/10EPSS 2.20%

Last modified

CVE-2020-25685 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. EPSS estimates a 2.20% chance of exploitation in the next 30 days.

Description

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

Metrics

CVSS 3.1
3.7/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Probability
2.20%

80.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ThekelleysDnsmasq< 2.83
FedoraprojectFedora32
FedoraprojectFedora33
DebianDebian Linux10.0
AristaEos>= 4.21, < 4.21.14m
AristaEos>= 4.22, < 4.22.9m
AristaEos>= 4.23, < 4.23.7m
AristaEos>= 4.24, < 4.24.5m
AristaEos>= 4.25, < 4.25.2f

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-25685?
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
How severe is CVE-2020-25685?
CVE-2020-25685 has a CVSS score of 3.7/10 (LOW severity). The EPSS model estimates a 2.20% probability of exploitation in the next 30 days.
How do I fix CVE-2020-25685?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-25685?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST