CVE-2017-14491: arista eos Out-of-bounds Write
CVSS: 9.8v3.1CriticalModified
AliasesALPINE-CVE-2017-14491RHSA-2017:2838RHSA-2017:2839RHSA-2017:2840RHSA-2017:2841UBUNTU-CVE-2017-14491DEBIAN-CVE-2017-14491
Published 02-10-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-14491 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in arista eos. EPSS estimates a 84.92% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
84.92%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference, exploit-database
Advisory lineage
Upstream 0 · Downstream 12 · Related 6Timeline
- 02-10-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
CVSS metrics
7 scores · 5 sources · 3 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Critical 9.8Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
84.92%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 84.92% on 19-09-2026
19-09-202619-10-2026
EPSS score84.92%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Dnsmasq < 2.78 - 2-byte Heap Overflow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_workstation6.0 | 7.0
- dnsmasq< 0:2.48-18.el6_9 | < 0:2.48-16.el6_7.1 | < 0:2.48-5.el6_2.2 | < 0:2.48-13.el6_4.1 | < 0:2.48-13.el6_5.1 | < 0:2.48-14.el6_6.1 | < 0:2.45-2.el5_11.1 | < 0:2.45-2.el5_9.1
- dnsmasq-debuginfo< 0:2.48-18.el6_9 | < 0:2.48-16.el6_7.1 | < 0:2.48-5.el6_2.2 | < 0:2.48-13.el6_4.1 | < 0:2.48-13.el6_5.1 | < 0:2.48-14.el6_6.1 | < 0:2.45-2.el5_11.1 | < 0:2.45-2.el5_9.1
Siemens4 products
- ruggedcom_rm1224_firmware< 5.0
- scalance_m-800_firmware< 5.0
- scalance_s615_firmware< 5.0
- scalance_w1750d_firmware< 6.5.1.5
Suse3 products
- linux_enterprise_debuginfo11:sp3 | 11:sp4
- linux_enterprise_point_of_sale11:sp3
- linux_enterprise_server11:sp3 | 11:sp4 | 12
Debian2 products
- dnsmasq< 2.78-1
- debian_linuxEOL7.0 | 7.1 | 8.0 | 9.0
Nvidia2 products
- geforce_experience≥ 3.0, < 3.10.0.55
- linux_for_tegra< r21.6 | < r24.2.2
Synology2 products
- diskstation_manager5.2 | 6.0 | 6.1
- router_manager1.1
Alpine1 product
- dnsmasq< 2.78-r0 | < 2.76-r1 | < 2.76-r2 | < 2.76-r5
Arista1 product
- eos≤ 4.15 | ≥ 4.16, < 4.16.13m | ≥ 4.17, < 4.17.8m | ≥ 4.18, ≤ 4.18.4.2f
Arubanetworks1 product
- arubaos≥ 6.3.1, < 6.3.1.25 | ≥ 6.4.4.0, < 6.4.4.16 | ≥ 6.5.0.0, < 6.5.1.9 | ≥ 6.5.3.0, < 6.5.3.3 | ≥ 6.5.4.0, < 6.5.4.2 | ≥ 8.1.0.0, < 8.1.0.4
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 17.04
Huawei1 product
- honor_v9_play_firmware< jimmy-al00ac00b135
Opensuse1 product
- leapEOL42.2 | 42.3
Thekelleys1 product
- dnsmasq≤ 2.77
Ubuntu1 product
- dnsmasq< 2.68-1ubuntu0.2 | < 2.75-1ubuntu0.16.04.3
14 vendors · 27 products
References
54 links
- access.redhat.com/errata/RHSA-2017:2838Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
Show all 54 references
- access.redhat.com/errata/RHSA-2017:2840Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2017:2839Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.htmlMailing ListX Refsource MLIST
- access.redhat.com/errata/RHSA-2017:2841Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.htmlX Refsource MISCThird Party AdvisoryARTICLEREPORT
- www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.htmlMailing ListX Refsource MLIST
- packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-enX Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30X Refsource MISCMitigationThird Party Advisory
