Overview

On January 21, 2021, CERT/CC publically disclosed multiple vulnerability within dnsmasq: CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25684, CVE-2020-25685, CVE-2020-25686, CVE-2020-25687. Industry and Author refers to this series of vulnerabilities as DNSpooq. DNSpooq vulnerabilities include DNS cache poisoning vulnerabilities as well as a potential Remote Code Execution and exploits.

The list of devices industry-wide using dnsmasq that are affected by DNSpooq is long and varied.

Public Disclosures

      https://www.jsof-tech.com/disclosures/dnspooq/
      https://access.redhat.com/security/vulnerabilities/RHSB-2021-001
      https://us-cert.cisa.gov/ics/advisories/icsa-21-019-01

DNSpooq Vulnerability set divides into 2 types of vulnerabilities:

      1. DNS cache poisoning attacks, similar to the Kaminsky attack, but different in some aspects.
      2. Buffer overflow vulnerabilities that could lead to remote code execution.

DNSmasq below v2.83 is affected by the DNSpooq vulnerabilities:

JSOF reported multiple memory corruption vulnerabilities in dnsmasq due to boundary checking errors in DNSSEC handling code.

    CVE-2020-25681: A heap-based buffer overflow in dnsmasq in the way it sorts RRSets before validating them with DNSSEC data in an unsolicited DNS response
    CVE-2020-25682: A buffer overflow vulnerability in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data
    CVE-2020-25683: A heap-based buffer overflow in get_rdata subroutine of dnsmasq, when DNSSEC is enabled and before it validates the received DNS entries
    CVE-2020-25687: A heap-based buffer overflow in sort_rrset subroutine of dnsmasq, when DNSSEC is enabled and before it validates the received DNS entries

JSOF also reported vulnerabilities in DNS response validation that can result in DNS cache poisoning.

    CVE-2020-25684: Dnsmasq does not validate the combination of address/port and the query-id fields of DNS request when accepting DNS responses
    CVE-2020-25685: Dnsmasq uses a weak hashing algorithm (CRC32) when compiled without DNSSEC to validate DNS responses
    CVE-2020-25686: Dnsmasq does not check for an existing pending request for the same name and forwards a new request thus allowing an attacker to perform a "Birthday Attack" scenario to forge replies and potentially poison the DNS cache.

Affected Products

Regarding the Security patch for your D-Link Devices

Firmware updates address the security vulnerabilities in affected D-Link devices. D-Link will update this continually, and we strongly recommend all users to install the relevant updates.

Please note that this is a device beta software, beta firmware, or hot-fix release which is still undergoing final testing before its official release. The beta software, beta firmware, or hot-fix is provided on an "as is" and "as available" basis, and the user assumes all risk and liability for use thereof. D-Link does not offer any warranties, whether express or implied, as to the beta firmware's suitability or usability. D-Link will not be liable for any loss, whether such loss is direct, indirect, special, or consequential, suffered by any party due to their use of the beta firmware.

As there are different hardware revisions on our products, please check this on your device before downloading the correct corresponding firmware update. The hardware revision information can usually be found on the product label on the product's underside next to the serial number. Alternatively, they can also be found on the device web configuration.

--