Full Report
Security researchers discovered and disclosed seven vulnerabilities in the open-source DNS component “dnsmasq”, also known as “DNSpooq” vulnerabilities (CVE-2020-25681 through CVE-2020-25687). Three vulnerabilities (CVE-2020-25684 through CVE-2020-25686) affect the validation of DNS responses and impact several SCALANCE and RUGGEDCOM devices as listed below. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
Analysis Summary
# Vulnerability: DNSpooq - Multiple Vulnerabilities in Dnsmasq (Siemens SCALANCE and RUGGEDCOM)
## CVE Details
- **CVE ID:** CVE-2020-25684, CVE-2020-25685, CVE-2020-25686
- **CVSS Score:**
- CVE-2020-25684: 4.0 (Medium)
- CVE-2020-25685: 4.0 (Medium)
- CVE-2020-25686: 4.0 (Medium)
- **CWE:** CWE-330 (Use of Insufficiently Random Values), CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:**
- SCALANCE W700 Family (W721, W722, W734, W748, W761, W774, W778, W786, W788)
- SCALANCE W1700 Family (W1748, W1788)
- SCALANCE M-800 / S615
- RUGGEDCOM RM1224
- **Versions:** All versions prior to those listed in the remediation section.
- **Configurations:** Systems utilizing the integrated `dnsmasq` component for DNS caching or forwarding.
## Vulnerability Description
These vulnerabilities, collectively part of the "DNSpooq" set, reside in the DNS response validation logic of `dnsmasq`:
- **CVE-2020-25684:** Lack of proper entropy in the TXID (Transaction ID) and source port selection.
- **CVE-2020-25685:** Insufficient verification of query names in DNS responses.
- **CVE-2020-25686:** Failure to check if a pending query matches the incoming response's name/type.
Technically, these flaws allow an attacker to successfully spoof DNS responses. By predicting transaction IDs or bypassing validation checks, an attacker can inject malicious DNS entries into the device's cache (Cache Poisoning).
## Exploitation
- **Status:** Proof-of-Concept (PoC) available; researchers have demonstrated the feasibility of DNS Cache Poisoning.
- **Complexity:** Medium (Requires timing the response and potentially multiple attempts to match the TXID/port).
- **Attack Vector:** Network (Remote attackers can trigger these flaws if they can send malicious DNS responses to the device).
## Impact
- **Confidentiality:** None (Directly), though it enables Man-in-the-Middle (MitM) attacks.
- **Integrity:** High (Attackers can redirect traffic to malicious IP addresses).
- **Availability:** Low (Can lead to denial of service if legitimate domains are pointed to null addresses).
## Remediation
### Patches
Siemens has released the following updates (or newer) to address these issues:
- **SCALANCE W700:** Update to v6.5.0 or later.
- **SCALANCE W1700:** Update to v2.0.0 or later.
- **SCALANCE M-800 / S615:** Update to v6.4 or later.
- **RUGGEDCOM RM1224:** Update to v6.4 or later.
### Workarounds
For devices where patches are not yet applied:
- Disable the DNS caching/forwarding feature if not strictly required.
- Use a trusted upstream DNS server and ensure the network path to it is secure.
- Configure firewall rules to restrict DNS traffic (Port 53) only to known, authorized DNS servers.
## Detection
- **Indicators of compromise:** Presence of unexpected or unauthorized IP addresses in the device DNS cache.
- **Detection methods and tools:** Network security monitoring (NSM) can detect an unusual volume of DNS responses or mismatched TXIDs/ports targeting the device.
## References
- **Vendor Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-124031[.]pdf
- **Dnsmasq Project:** hxxp[://]thekelleys[.]org[.]uk/dnsmasq/doc[.]html
- **JSOF Research (DNSpooq):** hxxps[://]www[.]jsof-tech[.]com/disclosures/dnspooq/