3 ms·
Of the three RCEs, two of them are in the DHCP server subsystem, which means they can only be exploited by a device that successfully authenticates to your loca
by agwa 9y ago
Of the three RCEs, two of them are in the DHCP server subsystem, which means they can only be exploited by a device that successfully authenticates to your local network.
The other RCE is in the DNS subsystem, and can apparently be exploited by making a PTR record lookup to an attacker-controlled DNS server:
https://github.com/google/security-research-pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14491-instructions.txt https://github.com/google/security-research-pocs/blob/master...
My first question is: can you induce people to make PTR lookups? I don't think there's a way to make a browser do a PTR lookup, which may limit the remote exploitability of this vulnerability.
My second question is: can the vulnerability be exploited with an A/AAAA record lookup instead? If so, that would open a very devastating remote attack vector, as a website would need only include a hidden image tag pointing to an attacker-controlled domain in order to get RCE on someone's router.
- oasisbob 9y agore PTR reverse lookups - mail servers probably do it the most? That and administration / network management tools.
- agwa 9y agoAgreed, but such software rarely runs on a home network with a cheap router. dnsmasq is used elsewhere, of course, but those deployments are far more likely to receive security updates.
- agwa 9y agoThe author of dnsmasq says it has to be a PTR lookup: https://twitter.com/SimonRKelley/status/914918747978305537 https://twitter.com/SimonRKelley/status/914918747978305537 That's very good news. Edit: never mind, he says a CNAME answer to a A/AAAA query can trigger vulnerability. That's very bad news.
- deleted 9y ago[deleted]
- AndyMcConachie 9y agoIf that's true this is really really bad news. I mean I can't even begin to describe how bad this is.
- Ajedi32 9y agoAccording to the blog post, that CVE (CVE-2017-14491) only allows a 2-byte overflow on Dnsmasq >=2.76, so hopefully that's enough to prevent it from being exploited effectively. 2.76 was only released 16 months ago though. There are probably tons of router firmwares out there that are way older than that.
- fulafel 9y agoIt's unlikely that even the latest firmwares follow dnsmasq releases that closely, safe to assume that ~ all CPE devices are wormable. (And most of the devices out there will never get updated even after this, just replaced one day)
- y0ghur7_xxx 9y agoubuntu 16.04.3 uses dnsmasq 2.75