dnsmasq by Simon Kelley (Update A)
Security researchers discovered and disclosed seven vulnerabilities in the open-source DNS component "dnsmasq", also known as "DNSpooq" vulnerabilities (CVE-2020-25681 through CVE-2020-25687). Three vulnerabilities (CVE-2020-25684 through CVE-2020-25686) affect the validation of DNS responses and impact several SCALANCE and RUGGEDCOM devices as listed below. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-25686US | low3.7OT elevated | Exploit | ||
A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By def… | ||||
| CVE-2020-25685US | low3.7 | — | ||
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches t… | ||||
| CVE-2020-25684US | low3.7 | — | ||
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is… | ||||
references
External citations — patches, advisories, analysis.
- SSA-646763: DNSpooq - Dnsmasq Vulnerabilities in SCALANCE and RUGGEDCOM Devices - CSAF Versionself
- SSA-646763: DNSpooq - Dnsmasq Vulnerabilities in SCALANCE and RUGGEDCOM Devices - PDF Versionself
- SSA-646763: DNSpooq - Dnsmasq Vulnerabilities in SCALANCE and RUGGEDCOM Devices - TXT Versionself
- ICS Advisory ICSA-21-019-01 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-019-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (30)
- MitigationRUGGEDCOM RM1224
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationRUGGEDCOM RM1224
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationRUGGEDCOM RM1224
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE M-800
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE M-800
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE M-800
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE S615
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE S615
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE S615
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE SC-600
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE SC-600
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE SC-600
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE W1750D
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE W1750D
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- MitigationSCALANCE W1750D
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
- No fix availableSCALANCE W1750D
Currently no remediation is available
- No fix availableSCALANCE W1750D
Currently no remediation is available
- No fix availableSCALANCE W1750D
Currently no remediation is available
- FixedRUGGEDCOM RM1224
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedRUGGEDCOM RM1224
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedRUGGEDCOM RM1224
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE M-800
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE M-800
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE M-800
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE S615
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE S615
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE S615
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE SC-600
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/ - FixedSCALANCE SC-600
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/ - FixedSCALANCE SC-600
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan