NewsSiemens ProductCERT

SSA-646763 V1.0: DNSpooq - Dnsmasq Vulnerabilities in SCALANCE and RUGGEDCOM Devices

Security researchers discovered and disclosed seven vulnerabilities in the open-source DNS component “dnsmasq”, also known as “DNSpooq” vulnerabilities (CVE-2020-25681 through CVE-2020-25687). Three vulnerabilities (CVE-2020-25684 through CVE-2020-25686) affect the validation of DNS responses and impact several SCALANCE and RUGGEDCOM devices as listed below. Siemens is preparing updates and recommends countermeasures for products where updates are not, or not yet available.

CVE-2020-25687Dnsmasq: Heap-basierter Pufferüberlauf
CVE-2020-25684CVE-2020-25684
CVE-2020-25681Debian dnsmasq: security update
CVE-2020-25686Dnsmasq: fehlerhaft implementierte Sicherheitsprüfung
CVE-2020-25681Multiple Vulnerabilities in Dnsmasq
CVE-2020-25681CVE-2020-25681
CVE-2020-25681Dnsmasq: Heap-basierter Pufferüberlauf
CVE-2020-25687CVE-2020-25687
CVE-2020-25684Dnsmasq: fehlerhaft implementierte Sicherheitsprüfung
CVE-2020-25686CVE-2020-25686

Affected vendors and products

Arista Networks Arista EOS
Debian Debian Linux
Debian Dnsmasq
Fedora Project Infrastructure Fedora
Thekelleys thekelleys dnsmasq

Source: https://cert-portal.siemens.com/productcert/pdf/ssa-646763.pdf

Linked advisories

Affected vendors and products