Sign-up

ID

VAR-201801-0885


CVE

CVE-2017-15107


TITLE

Dnsmasq Access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-012223

DESCRIPTION

A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist. Dnsmasq Contains an access control vulnerability.Information may be tampered with. Dnsmasq is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. ========================================================================== Ubuntu Security Notice USN-4924-1 April 22, 2021 dnsmasq vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Dnsmasq. Software Description: - dnsmasq: Small caching DNS proxy and DHCP/TFTP server Details: It was discovered that Dnsmasq incorrectly handled certain wildcard synthesized NSEC records. (CVE-2017-15107) It was discovered that Dnsmasq incorrectly handled certain large DNS packets. A remote attacker could possibly use this issue to cause Dnsmasq to crash, resulting in a denial of service. (CVE-2019-14513) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: dnsmasq 2.75-1ubuntu0.16.04.10 dnsmasq-base 2.75-1ubuntu0.16.04.10 dnsmasq-utils 2.75-1ubuntu0.16.04.10 After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4924-1 CVE-2017-15107, CVE-2019-14513 Package Information: https://launchpad.net/ubuntu/+source/dnsmasq/2.75-1ubuntu0.16.04.10

Trust: 2.07

sources: NVD: CVE-2017-15107 // JVNDB: JVNDB-2017-012223 // BID: 102812 // VULMON: CVE-2017-15107 // PACKETSTORM: 162315

AFFECTED PRODUCTS

vendor:thekelleysmodel:dnsmasqscope:lteversion:2.78

Trust: 1.8

vendor:thekelleysmodel:dnsmasqscope:eqversion:2.78

Trust: 0.6

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.78

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.62

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.50

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.49

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.48

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.47

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.46

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.45

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.44

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.43

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.42

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.41

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.40

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.35

Trust: 0.3

vendor:dnsmasqmodel:dnsmasqscope:eqversion:2.30

Trust: 0.3

sources: BID: 102812 // JVNDB: JVNDB-2017-012223 // CNNVD: CNNVD-201801-879 // NVD: CVE-2017-15107

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-15107
value: HIGH

Trust: 1.0

NVD: CVE-2017-15107
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201801-879
value: HIGH

Trust: 0.6

VULMON: CVE-2017-15107
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-15107
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2017-15107
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULMON: CVE-2017-15107 // JVNDB: JVNDB-2017-012223 // CNNVD: CNNVD-201801-879 // NVD: CVE-2017-15107

PROBLEMTYPE DATA

problemtype:CWE-358

Trust: 1.0

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-284

Trust: 0.8

sources: JVNDB: JVNDB-2017-012223 // NVD: CVE-2017-15107

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 162315 // CNNVD: CNNVD-201801-879

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201801-879

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-012223

PATCH
title:DNSSEC security fix.url:http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/011896.html
Trust: 0.8
title:Dnsmasq Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78031
Trust: 0.6
title:Debian CVElist Bug Report Logs: dnsmasq: CVE-2017-15107url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=22416c383c2adcd1f93233f99ce94e13
Trust: 0.1
title:Arch Linux Advisories: [ASA-201801-32] dnsmasq: insufficient validationurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201801-32
Trust: 0.1
title:Red Hat: CVE-2017-15107url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2017-15107
Trust: 0.1
title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2017-15107
Trust: 0.1
title:router-configurl:https://github.com/lesinh97/router-config 
Trust: 0.1
title:nixos-issue-db-exampleurl:https://github.com/andir/nixos-issue-db-example 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-15107 // 
            
            
            
            JVNDB: JVNDB-2017-012223 // 
            
            
            
            CNNVD: CNNVD-201801-879

EXTERNAL IDS
db:NVDid:CVE-2017-15107
Trust: 2.9
db:BIDid:102812
Trust: 2.0
db:JVNDBid:JVNDB-2017-012223
Trust: 0.8
db:PACKETSTORMid:162315
Trust: 0.7
db:AUSCERTid:ESB-2019.4570
Trust: 0.6
db:AUSCERTid:ESB-2021.1383
Trust: 0.6
db:AUSCERTid:ESB-2019.2421
Trust: 0.6
db:AUSCERTid:ESB-2019.3767
Trust: 0.6
db:CNNVDid:CNNVD-201801-879
Trust: 0.6
db:VULMONid:CVE-2017-15107
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-15107 // 
            
            
            
            BID: 102812 // 
            
            
            
            JVNDB: JVNDB-2017-012223 // 
            
            
            
            PACKETSTORM: 162315 // 
            
            
            
            CNNVD: CNNVD-201801-879 // 
            
            
            
            NVD: CVE-2017-15107

REFERENCES
url:http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/011896.html
Trust: 2.0
url:http://www.securityfocus.com/bid/102812
Trust: 1.7
url:http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00027.html
Trust: 1.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-15107
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-15107
Trust: 0.8
url:https://www.suse.com/support/update/announcement/2019/suse-su-20193189-1.html
Trust: 0.6
url:https://www.suse.com/support/update/announcement/2019/suse-su-20193188-1.html
Trust: 0.6
url:https://www.suse.com/support/update/announcement/2019/suse-su-201914190-1.html
Trust: 0.6
url:https://www.suse.com/support/update/announcement/2019/suse-su-20191721-1.html
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.1383
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.4570/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.3767/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.2421/
Trust: 0.6
url:https://packetstormsecurity.com/files/162315/ubuntu-security-notice-usn-4924-1.html
Trust: 0.6
url:https://access.redhat.com/security/cve/cve-2017-15107
Trust: 0.4
url:https://bugzilla.redhat.com/show_bug.cgi?id=1510570
Trust: 0.3
url:http://www.thekelleys.org.uk/dnsmasq/doc.html
Trust: 0.3
url:http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=4fe6744a220eddd3f1749b40cac3dfc510787de6
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://www.rapid7.com/db/vulnerabilities/alpine-linux-cve-2017-15107
Trust: 0.1
url:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888200
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/dnsmasq/2.75-1ubuntu0.16.04.10
Trust: 0.1
url:https://ubuntu.com/security/notices/usn-4924-1
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2019-14513
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-15107 // 
            
            
            
            BID: 102812 // 
            
            
            
            JVNDB: JVNDB-2017-012223 // 
            
            
            
            PACKETSTORM: 162315 // 
            
            
            
            CNNVD: CNNVD-201801-879 // 
            
            
            
            NVD: CVE-2017-15107

CREDITS
Ubuntu
Trust: 0.7
sources:
            
            
            PACKETSTORM: 162315 // 
            
            
            
            CNNVD: CNNVD-201801-879

SOURCES
db:VULMONid:CVE-2017-15107
db:BIDid:102812
db:JVNDBid:JVNDB-2017-012223
db:PACKETSTORMid:162315
db:CNNVDid:CNNVD-201801-879
db:NVDid:CVE-2017-15107

LAST UPDATE DATE
2024-11-23T19:31:51.795000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2017-15107date:2019-10-09T00:00:00
db:BIDid:102812date:2018-01-19T00:00:00
db:JVNDBid:JVNDB-2017-012223date:2018-02-27T00:00:00
db:CNNVDid:CNNVD-201801-879date:2021-04-25T00:00:00
db:NVDid:CVE-2017-15107date:2024-11-21T03:14:05.250

SOURCES RELEASE DATE
db:VULMONid:CVE-2017-15107date:2018-01-23T00:00:00
db:BIDid:102812date:2018-01-19T00:00:00
db:JVNDBid:JVNDB-2017-012223date:2018-02-27T00:00:00
db:PACKETSTORMid:162315date:2021-04-23T15:36:14
db:CNNVDid:CNNVD-201801-879date:2018-01-24T00:00:00
db:NVDid:CVE-2017-15107date:2018-01-23T16:29:00.477