Published: 03/10/2017 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

In dnsmasq prior to 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
debian debian linux 7.1
novell leap 42.2
debian debian linux 7.0
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
canonical ubuntu linux 17.04
debian debian linux 9.0
fedoraproject fedora 27
novell leap 42.3
thekelleys dnsmasq

Debian Bug report logs - #877102 dnsmasq: CVE-2017-13704: Size parameter overflow via large DNS query Package: src:dnsmasq; Maintainer for src:dnsmasq is Simon Kelley <simon@thekelleysorguk>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 28 Sep 2017 18:39:02 UTC Severity: grave Tags: fixed-upstre ...

An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the DNS code An attacker could send crafted DNS packets to dnsmasq which would cause it to crash ...

CWE-20 https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html http://www.securitytracker.com/id/1039474 http://www.securityfocus.com/bid/101085 https://access.redhat.com/security/vulnerabilities/3199382 http://www.securityfocus.com/bid/101977 https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf http://thekelleys.org.uk/dnsmasq/CHANGELOG https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TK6DWC53WSU6633EVZL7H4PCWBYHMHK/https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=63437ffbb58837b214b4b92cb1c54bc5f3279928 https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877102 https://access.redhat.com/security/cve/cve-2017-13704

CVE-2017-13704

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect