PublicDateAtUSN: 2021-01-19
Candidate: CVE-2020-25685
CRD: 2021-01-19
PublicDate: 2021-01-20 16:15:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25685
 https://www.jsof-tech.com/disclosures/dnspooq/
 http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html
 https://ubuntu.com/security/notices/USN-4698-1
Description:
 A flaw was found in dnsmasq before version 2.83. When getting a reply from
 a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the
 forwarded query that matches the reply, by only using a weak hash of the
 query name. Due to the weak hash (CRC32 when dnsmasq is compiled without
 DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find
 several different domains all having the same hash, substantially reducing
 the number of attempts they would have to perform to forge a reply and get
 it accepted by dnsmasq. This is in contrast with RFC5452, which specifies
 that the query name is one of the attributes of a query that must be used
 to match a reply. This flaw could be abused to perform a DNS Cache
 Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a
 successful attack is reduced. The highest threat from this vulnerability is
 to data integrity.
Ubuntu-Description: 
Notes: 
Mitigation: 
Bugs: 
Priority: medium
Discovered-by: Moshe Kol and Shlomi Oberman
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N [3.7 LOW]


Patches_dnsmasq:
upstream_dnsmasq: released (2.83)
precise/esm_dnsmasq: ignored (end of ESM support, was needs-triage)
trusty_dnsmasq: ignored (out of standard support)
trusty/esm_dnsmasq: needs-triage
xenial_dnsmasq: released (2.75-1ubuntu0.16.04.7)
esm-infra/xenial_dnsmasq: released (2.75-1ubuntu0.16.04.7)
bionic_dnsmasq: released (2.79-1ubuntu0.2)
focal_dnsmasq: released (2.80-1.1ubuntu1.2)
groovy_dnsmasq: released (2.82-1ubuntu1.1)
hirsute_dnsmasq: released (2.82-1ubuntu2)
impish_dnsmasq: released (2.82-1ubuntu2)
jammy_dnsmasq: released (2.82-1ubuntu2)
devel_dnsmasq: released (2.82-1ubuntu2)