SSA-646763

SSA-646763: DNSpooq - Dnsmasq Vulnerabilities in SCALANCE and RUGGEDCOM Devices

view advisory published 2021-01-19

Security researchers discovered and disclosed seven vulnerabilities in the open-source DNS component "dnsmasq", also known as "DNSpooq" vulnerabilities (CVE-2020-25681 through CVE-2020-25687). Three vulnerabilities (CVE-2020-25684 through CVE-2020-25686) affect the validation of DNS responses and impact several SCALANCE and RUGGEDCOM devices as listed below. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.

describes (3)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-25686US	low3.7OT elevated	5.47% (93rd)	Exploit	2021-01-20
A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By def…
CVE-2020-25685US	low3.7	2.23% (83rd)	—	2021-01-20
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches t…
CVE-2020-25684US	low3.7	4.16% (91st)	—	2021-01-20
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is…

references

External citations — patches, advisories, analysis.

remediations (30)

MitigationRUGGEDCOM RM1224
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationRUGGEDCOM RM1224
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationRUGGEDCOM RM1224
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE M-800
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE M-800
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE M-800
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE S615
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE S615
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE S615
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE SC-600
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE SC-600
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE SC-600
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE W1750D
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE W1750D
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
MitigationSCALANCE W1750D
RUGGEDCOM RM1224: Same as for SCALANCE M-800. Note that the DNS proxy is enabled by default.
No fix availableSCALANCE W1750D
Currently no remediation is available
No fix availableSCALANCE W1750D
Currently no remediation is available
No fix availableSCALANCE W1750D
Currently no remediation is available
FixedRUGGEDCOM RM1224
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
FixedRUGGEDCOM RM1224
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
FixedRUGGEDCOM RM1224
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
FixedSCALANCE M-800
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
FixedSCALANCE M-800
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
FixedSCALANCE M-800
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
FixedSCALANCE S615
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
FixedSCALANCE S615
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
FixedSCALANCE S615
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
FixedSCALANCE SC-600
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/
FixedSCALANCE SC-600
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/
FixedSCALANCE SC-600
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan