Summary
Security researchers discovered and disclosed seven vulnerabilities in the open-source DNS component "dnsmasq", also known as "DNSpooq" vulnerabilities (CVE-2020-25681 through CVE-2020-25687). Three vulnerabilities (CVE-2020-25684 through CVE-2020-25686) affect the validation of DNS responses and impact several SCALANCE and RUGGEDCOM devices as listed below.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
Vulnerabilities 3
-
Unscored —
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the for…
-
Unscored —
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward…
-
Unscored —CVE-2020-25686 Public exploit
A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending…
Revision history
-
#4
Clarified that a solution for SCALANCE W1750D is not expected
-
#3
Added solution for SCALANCE M-800/S615 and RUGGEDCOM RM1224
-
#2
Added solution for SCALANCE SC-600
-
#1
Publication Date
References
-
SSA-646763: DNSpooq - Dnsmasq Vulnerabilities in SCALANCE and RUGGEDCOM Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-646763.pdf
-
SSA-646763: DNSpooq - Dnsmasq Vulnerabilities in SCALANCE and RUGGEDCOM Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-646763.txt