SB2017100228 - Memory leak in dnsmasq (Alpine package)
Published: October 2, 2017
Security Bulletin ID
SB2017100228
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Memory leak (CVE-ID: CVE-2017-14494)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to memory leak when processing DHCPv6 requests. A remote unauthenticated attacker on local network can send specially crafted DHCPv6 request to the affected service and cause dnsmasq to forward memory from outside the packet buffer to a DHCPv6 server when acting as a relay.
Successful exploitation of this vulnerability may allow an attacker to read parts of memory from the affected system and bypass ASLR.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=3640e0ea2d3be8fc17d71b9faad5a0b8806d7f78
- https://git.alpinelinux.org/aports/commit/?id=3afe33ad348010beb44371a68febd5f2f252299a
- https://git.alpinelinux.org/aports/commit/?id=43dd2c9dbd748d5b095ba9eec3da18255d5bd158
- https://git.alpinelinux.org/aports/commit/?id=e2b7176ff9d902f7e8837d4a7ef0d560c903fc35