CVE-2020-25686

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.83

Description A flaw in dnsmasq allows an off-path attacker to substantially reduce the number of attempts needed to forge a reply and have it accepted by dnsmasq. This issue is related to the lack of checking for existing pending requests for the same name, which can lead to DNS cache poisoning. The highest threat from this vulnerability is to data integrity. If chained with another issue, the attack complexity of a successful attack is reduced.

Recommendations For dnsmasq versions prior to 2.83, update to version 2.83 or later to resolve the issue. As a temporary workaround, consider restricting the use of dnsmasq as a DNS server to minimize the risk of exploitation. Avoid using the EOS switch as a DNS server until the issue is resolved.