CVE-2017-15107

A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00027.html
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/011896.html	Vendor Advisory
http://www.securityfocus.com/bid/102812	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-01-23 16:29

Updated : 2023-12-10 12:30

NVD link : CVE-2017-15107

Mitre link : CVE-2017-15107

CVE.ORG link : CVE-2017-15107

JSON object : View

Products Affected

thekelleys

dnsmasq

CWE

NVD-CWE-noinfo CWE-358

Improperly Implemented Security Check for Standard

{"id": "CVE-2017-15107", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-01-23T16:29:00.477", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00027.html", "source": "secalert@redhat.com"}, {"url": "http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/011896.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/102812", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-358"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad en la implementaci\u00f3n de DNSSEC en Dnsmasq hasta la versi\u00f3n 2.78, tambi\u00e9n incluida. Los registros NSEC sintetizados con caracteres comod\u00edn podr\u00edan interpretarse err\u00f3neamente para probar la falta de nombres de host que existen de verdad."}], "lastModified": "2019-10-09T23:24:13.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "440717BE-EAFE-4FB2-B33B-FDC89BA94E5C", "versionEndIncluding": "2.78"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}