Comment by agwa | Hacker News Reader

Comment by agwa | Hacker News Reader

Parent Full thread

Of the three RCEs, two of them are in the DHCP server subsystem, which means they can only be exploited by a device that successfully authenticates to your local network.

The other RCE is in the DNS subsystem, and can apparently be exploited by making a PTR record lookup to an attacker-controlled DNS server:

https://github.com/google/security-research-pocs/blob/master...

My first question is: can you induce people to make PTR lookups? I don't think there's a way to make a browser do a PTR lookup, which may limit the remote exploitability of this vulnerability.

My second question is: can the vulnerability be exploited with an A/AAAA record lookup instead? If so, that would open a very devastating remote attack vector, as a website would need only include a hidden image tag pointing to an attacker-controlled domain in order to get RCE on someone's router.

The author of dnsmasq says it has to be a PTR lookup: https://twitter.com/SimonRKelley/status/914918747978305537

That's very good news.

Edit: never mind, he says a CNAME answer to a A/AAAA query can trigger vulnerability. That's very bad news.

If that's true this is really really bad news. I mean I can't even begin to describe how bad this is.

According to the blog post, that CVE (CVE-2017-14491) only allows a 2-byte overflow on Dnsmasq >=2.76, so hopefully that's enough to prevent it from being exploited effectively.

2.76 was only released 16 months ago though. There are probably tons of router firmwares out there that are way older than that.

It's unlikely that even the latest firmwares follow dnsmasq releases that closely, safe to assume that ~ all CPE devices are wormable.

(And most of the devices out there will never get updated even after this, just replaced one day)

ubuntu 16.04.3 uses dnsmasq 2.75

re PTR reverse lookups - mail servers probably do it the most? That and administration / network management tools.

Agreed, but such software rarely runs on a home network with a cheap router.

dnsmasq is used elsewhere, of course, but those deployments are far more likely to receive security updates.

Reply on news.ycombinator.com