aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/ixp4xx
diff options
context:
space:
mode:
authorHauke Mehrtens <hauke@hauke-m.de>2021-01-11 01:03:03 +0100
committerHauke Mehrtens <hauke@hauke-m.de>2021-01-19 14:10:02 +0100
commit8055e38794741313f8f4e6059f83c71dc0ab1d1c (patch)
tree8a7f2e7015db5f51e2fb49c6f92a8accdfa3b4cb /target/linux/ixp4xx
parent733e62a8e14e639cdc719256ae644e6b1474614b (diff)
downloadupstream-8055e38794741313f8f4e6059f83c71dc0ab1d1c.tar.gz
upstream-8055e38794741313f8f4e6059f83c71dc0ab1d1c.tar.bz2
upstream-8055e38794741313f8f4e6059f83c71dc0ab1d1c.zip
dnsmasq: Backport some security updates
This fixes the following security problems in dnsmasq: * CVE-2020-25681: Dnsmasq versions before 2.83 is susceptible to a heap-based buffer overflow in sort_rrset() when DNSSEC is used. This can allow a remote attacker to write arbitrary data into target device's memory that can lead to memory corruption and other unexpected behaviors on the target device. * CVE-2020-25682: Dnsmasq versions before 2.83 is susceptible to buffer overflow in extract_name() function due to missing length check, when DNSSEC is enabled. This can allow a remote attacker to cause memory corruption on the target device. * CVE-2020-25683: Dnsmasq version before 2.83 is susceptible to a heap-based buffer overflow when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap- allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in Dnsmasq, resulting in a Denial of Service. * CVE-2020-25684: A lack of proper address/port check implemented in Dnsmasq version < 2.83 reply_query function makes forging replies easier to an off-path attacker. * CVE-2020-25685: A lack of query resource name (RRNAME) checks implemented in Dnsmasq's versions before 2.83 reply_query function allows remote attackers to spoof DNS traffic that can lead to DNS cache poisoning. * CVE-2020-25686: Multiple DNS query requests for the same resource name (RRNAME) by Dnsmasq versions before 2.83 allows for remote attackers to spoof DNS traffic, using a birthday attack (RFC 5452), that can lead to DNS cache poisoning. * CVE-2020-25687: Dnsmasq versions before 2.83 is vulnerable to a heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of Service. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Diffstat (limited to 'target/linux/ixp4xx')
0 files changed, 0 insertions, 0 deletions