==================================================================== CERT-Renater Note d'Information No. 2021/VULN031 _____________________________________________________________________ DATE : 19/01/2021 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Cisco software releases running Dnsmasq DNS Forwarder. ===================================================================== https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnsmasq-dns-2021-c5mrdf3g _____________________________________________________________________ Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021 Medium Advisory ID: cisco-sa-dnsmasq-dns-2021-c5mrdf3g First Published: 2021 January 19 12:15 GMT Version 1.0: Interim Workarounds: No workarounds available Cisco Bug IDs: CSCvv83754 CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 CVE-2020-25687 CWE-340 Summary A set of previously unknown vulnerabilities in the DNS forwarder implementation of dnsmasq were disclosed on January 19, 2021. The vulnerabilities are collectively known as DNSpooq. Exploitation of these vulnerabilities could result in remote code execution or denial of service (DoS), or may allow an attacker to more easily forge DNS answers that can poison DNS caches, depending on the specific vulnerability. Multiple Cisco products are affected by these vulnerabilities. Cisco will release software updates that address these vulnerabilities. Any workarounds for a specific Cisco product or service will be documented in the relevant Cisco bugs, which are identified in the Vulnerable Products section of this advisory. Note: At the time of publication, no Cisco products were found to be affected by the remote code execution and DoS vulnerabilities, which are identified by the following Common Vulnerabilities and Exposures (CVE) IDs: CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25687 This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnsmasq-dns-2021-c5mrdf3g Affected Products Cisco investigated its product line to determine which products may be affected by these vulnerabilities. The Vulnerable Products section includes Cisco bug IDs for each affected product or service. The bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases. Any product or service not listed in Vulnerable Products section of this advisory is to be considered not vulnerable. Vulnerable Products For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. At the time of this investigation, no Cisco products have been found to be affected by the remote code execution and DoS vulnerabilities. Multiple Cisco products have been found to be susceptible to DNS cache poisoning attacks. The following table lists Cisco products that have been found to be susceptible to DNS cache poisoning attacks. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes. If no version or date is listed for an affected component (indicated by a blank field and/or an advisory designation of Interim), Cisco is continuing to evaluate the fix and will update the advisory as additional information becomes available. After the advisory is marked Final, customers should refer to the associated Cisco bug(s) for further details. Product Cisco Bug ID Fixed Release Availability Network Management and Provisioning Cisco Aironet 1560 Series Access Points CSCvv83754 8.10MR5 (Feb 2021) 8.5MR7 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Aironet 1810 Series OfficeExtend Access Points CSCvv83754 8.10MR5 (Feb 2021) 8.5MR7 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Aironet 1810w Series Access Points CSCvv83754 8.10MR5 (Feb 2021) 8.5MR7 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Aironet 1815 Series Access Points CSCvv83754 8.10MR5 (Feb 2021) 8.5MR7 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Aironet 1830 Series Access Points CSCvv83754 8.10MR5 (Feb 2021) 8.5MR7 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Aironet 1850 Series Access Points CSCvv83754 8.10MR5 (Feb 2021) 8.5MR7 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Aironet 2800 Series Access Points CSCvv83754 8.10MR5 (Feb 2021) 8.5MR7 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Aironet 3800 Series Access Points CSCvv83754 8.10MR5 (Feb 2021) 8.5MR7 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Aironet 4800 Access Points CSCvv83754 8.10MR5 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Business 100 Series Access Points CSCvv83754 10.4.1.0 (Feb 2021) Cisco Business 200 Series Access Points CSCvv83754 10.4.1.0 (Feb 2021) Cisco Catalyst 9100 Access Points CSCvv83754 8.10MR5 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Catalyst IW 6300 Access Points CSCvv83754 8.10MR5 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco ESW6300 Series Access Points CSCvv83754 8.10MR5 (Feb 2021) 16.12.5 (Feb 2021) 17.3.3 (Feb 2021) 17.5.1 (Mar 2021) Cisco Policy Suite CSCvv83241 21.1.0 (Jan 2021) Routing and Switching - Enterprise and Service Provider Cisco 1000 Series Connected Grid Routers (CGR1000 compute module) CSCvv84554 Cisco IR800 Integrated Services Router (Guest OS) CSCvv84553 Cisco Wireless Gateway for LoRaWAN CSCvw00914 2.1.0.3 (Mar 2021) Meraki Products Cisco Meraki MR (all models) N/A MR 27 firmware 27.5.1 or later Cisco Meraki MS (all models) N/A MS 12 firmware 12.28 or later MS 14 firmware 14.11 or later Cisco Meraki MV (all models) N/A MV 4 firmware 4.8 or later Cisco Meraki MX (all models) N/A MX 14 firmware 14.53 or later MX 15 firmware 15.41 or later Cisco Meraki Z-Series (all models) N/A Firmware 14.53 or later Firmware 15.41 or later Routing and Switching - Small Business Cisco RV042 Dual WAN VPN Router CSCvv83789 None planned Cisco RV042G Dual Gigabit WAN VPN Router CSCvv83789 None planned Cisco RV160x VPN Router CSCvv83787 Cisco RV260x VPN Router CSCvv83788 Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router CSCvv83239 Cisco Small Business RV Series RV110W Wireless-N VPN Firewall CSCvv83235 None planned Cisco Small Business RV Series RV215W Wireless-N VPN Router CSCvv83237 None planned Cisco Small Business RV Series RV320 Dual Gigabit WAN VPN Router CSCvv83238 Cisco Small Business RV Series RV325 Dual WAN VPN Router CSCvv83816 None planned Cisco Small Business RV130 Series VPN Routers CSCvv83791 None planned Cisco Small Business RV130 VPN Router CSCvv83236 None planned Unified Computing Cisco Enterprise NFV Infrastructure Software (NFVIS) CSCvw00975 Voice and Unified Communications Devices Cisco IP Conference Phone 7832 CSCvv83246 Cisco IP Conference Phone 8832 CSCvv83250 Cisco IP Phone 6800 Series with Multiplatform Firmware CSCvv83248 Cisco IP Phone 6821 with Multiplatform Firmware CSCvw00982 Cisco IP Phone 7800 Series with Multiplatform Firmware CSCvv83243 Cisco IP Phone 7800 Series CSCvv83249 Cisco IP Phone 8800 Series with Multiplatform Firmware CSCvv83242 Cisco IP Phone 8865 CSCvv83245 Release no. TBD (Mar 2021) Cisco SPA112 2-Port Phone Adapter CSCvv83234 None planned Cisco SPA122 Analog Telephone Adapter (ATA) with Router CSCvv83234 None planned Cisco SPA232D Multi-Line DECT Analog Telephone Adapter (ATA) CSCvv83234 None planned Cisco Unified IP Phone 9951 CSCvv83247 None planned Cisco Unified IP Phone 9971 CSCvv83247 None planned Cisco Wireless IP Phone 8821 CSCvw00918 Video, Streaming, TelePresence, and Transcoding Devices Cisco Expressway Series CSCvv83227 X12.7.1 (Feb 2021) Cisco TelePresence Video Communication Server (VCS) CSCvv83227 X12.7.1 (Feb 2021) Cisco Cloud Hosted Services Cisco IP Phone 6800 Series CSCvw01205 Cisco Spark Calling CSCvw00907 X12.7.1 (Feb 2021) Cisco Webex Teams (formerly Cisco Spark) CSCvv83214 None planned Webex Room Phone CSCvv87082 Products Under Investigation Routing and Switching - Enterprise and Service Provider Cisco IOS XE Software Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by these vulnerabilities. Cisco products that do not offer DNS server capabilities are not affected by these vulnerabilities. At the time of publication, no Cisco products were found to be affected by the vulnerabilities identified by the following Common Vulnerabilities and Exposures (CVE) IDs: CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25687 Details Remote Code Execution and Denial of Service Vulnerabilities Multiple vulnerabilities in the DNSSEC implementation of dnsmasq could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. The vulnerabilities are due to improper memory management when the affected software processes DNS packets with DNSSEC data. An attacker could exploit these vulnerabilities by sending malicious DNS packets to be processed by the affected device. When these packets are processed, an exploitable overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the underlying dnsmasq software or cause DoS condition on the affected device. These vulnerabilities affect dnsmasq installations that match all of the following criteria: Include a vulnerable release of dnsmasq Capable of acting as a DNS server Capable of validating DNSSEC data These vulnerabilities have been assigned the following CVE IDs: CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25687 At the time of this investigation, no Cisco products have been found to be affected by these vulnerabilities. DNS Cache Poisoning Attacks Multiple weaknesses in the DNS server functionality of dnsmasq could allow an unauthenticated, remote attacker to more easily forge DNS answers that can poison DNS caches. Each weakness results in dnsmasq accepting DNS answers based on checks that are performed on an amount of entropy that is lower than what is mandated by RFC 5452. The combination of these weaknesses would allow an attacker to mount a successful DNS cache poisoning attack with low traffic requirements. These weaknesses affect dnsmasq installations that match all of the following criteria: Include a vulnerable release of dnsmasq Capable of acting as a DNS server Capable of caching DNS responses These weaknesses have been assigned the following CVE IDs: CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 Multiple Cisco products have been found to be susceptible to DNS cache poisoning attacks. Workarounds Any workarounds for a specific Cisco product or service will be documented in the relevant Cisco bugs, which are identified in the Vulnerable Products section of this advisory. Fixed Software For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products section of this advisory. When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Exploitation and Public Announcements The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory. Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory. Source Cisco would like to thank Moshe Kol and Shlomi Oberman of JSOF for reporting these vulnerabilities, which were investigated and disclosed under the coordination of CERT/CC. URL https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnsmasq-dns-2021-c5mrdf3g Revision History Version Description Section Status Date 1.0 Initial public release. — Interim 2021-JAN-19 Legal Disclaimer THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE. A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================