- StuffIt Deluxe Windows Updates Version 14.0.1 (Deluxe 2010) E/F/G/J Download 106.7MB IMPORTANT NOTE: If you are upgrading an x86 version of StuffIt 2010 from 14.0 to 14.0.1, you will first need to uninstall StuffIt using Add/Remove Progams in Window's Control Panel.
- In macOS High Sierra and earlier, you can install Windows 10, Windows 8.1, and Windows 7 using Boot Camp Assistant on supported Mac models. Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement.
- While updated software is already available for some products, many affected devices will not have fixes until February and March. Users can find a full list of affected products and when patches.
Yesterday, seven Dnsmasq vulnerabilities were disclosed, collectively known as DNSPooq, that attackers can use to launch DNS Cache Poisoning, denial of service, and possibly remote code execution attacks, on affected devices.
Dnsmasq is a widely used open-source Domain Name System (DNS) forwarding application commonly installed on routers, operating systems, access points, and other networking equipment.
Vendors have started to release information on how customers can protect themselves from DNSPooq. To make it easier to find this information, BleepingComputer will be listing security advisories as they are released.
The related CVEs from JSOF's DNSpooq advisory are listed below, along with their descriptions.
| Name | CVSS | Description |
|---|---|---|
| CVE-2020-25681 | 8.1 | Dnsmasq versions before 2.83are susceptible to a heap-based buffer overflow in sort_rrset() when DNSSEC is used. This can allow a remote attacker to write arbitrary data into target device’s memory that can lead to memory corruption and other unexpected behaviors on the target device. |
| CVE-2020-25682 | 8.1 | Dnsmasq versions before 2.83 are susceptible to buffer overflow in extract_name() function due to missing length check, when DNSSEC is enabled. This can allow a remote attacker to cause memory corruption on the target device. |
| CVE-2020-25683 | 5.9 | Dnsmasq versions before 2.83 are susceptible to a heap-based buffer overflow when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a Denial of Service. |
| CVE-2020-25687 | 5.9 | Dnsmasq versions before 2.83are vulnerable to a heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of Service. |
| CVE-2020-25684 | 4 | A lack of proper address/port check implemented in dnsmasq versions |
| CVE-2020-25685 | 4 | A lack of query resource name (RRNAME) checks implemented in dnsmasq’s versions before 2.83 reply_query function allows remote attackers to spoof DNS traffic that can lead to DNS cache poisoning. |
| CVE-2020-25686 | 4 | Multiple DNS query requests for the same resource name (RRNAME) by dnsmasq versions before 2.83 allows for remote attackers to spoof DNS traffic, using a birthday attack (RFC 5452), that can lead to DNS cache poisoning. |
Last chance to get 40% OFF PowerDVD 20! The best media player for home theater. 25% OFF Director Suite 365! The ultimate 4-in-1 creative editing suite. Software Updates. Choose the product to download updates for: RootsMagic; Personal Historian; Family Atlas.
BleepingComputer suggests checking this page throughout the coming days to see if new information is available for devices you may be using.
For more detailed information about the DNSpooq vulnerabilities, you can read the articles below:
Official Advisories, Notices, Patches, or Updates:
Below is a list of DNSPooq/dnsmasq advisories released by different vendors. The CERT Coordination Center is also maintaining a list of advisories shared with them.
If you are a vendor with an advisory or notice, please contact us to have your information added.
Last Updated: 01/20/21
Arista
Arista's advisory states that the DNSPooq vulnerabilities affect 'all EOS products including the 7xxx and 7xx Series switches and routers, and all CloudEOS packaging options.'
Arista has released updates that resolve the vulnerabilities and a hotfix if upgrading is not feasible at this time.
Cisco
Cisco released an advisory stating that 55 products and services are affected by the dnsmasq vulnerabilities. While updated software is already available for some products, many affected devices will not have fixes until February and March.
Users can find a full list of affected products and when patches will be available in the advisory.
DNSMasq
Simon Kelley, the maintainer of DNSpooq, has posted an advisory to the Dnsmasq-discuss mailing list. This advisory advises all dnsmasq users to upgrade to version 2.83 to resolve the vulnerabilities.
Their complete advisory is below.
'There are broadly two sets of problems. The first is subtle errors in dnsmasq's protections against the chronic weakness of the DNS protocol to cache-poisoning attacks; the Birthday attack, Kaminsky, etc. The code is now as secure as it can be, given that the real solution to this is DNSSEC, both endpoint validation and domains actually signing. This is covered by CVE-2020-25684, CVE-2020-25685 and CVE-2020-25686.
Unfortunately, given the above, the second set of errors is a good old fashioned buffer overflow in dnsmasq's DNSSEC code. If DNSSEC validation is enabled, an installation is at risk. This is covered by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683 and CVE-2020-25687.
Many, many people have worked over a considerable period to find these problems, fix them, and co-ordinate the security response. They are named in JSOF's disclosure, but special mention should go to Shlomi Oberman, Vijay Sarvepilli, Petr Menšík, and Dan Schaper.'
OpenWRT
OpenWRT has released an advisory explaining how you can upgrade your dnsmasq package to resolve the vulnerability using the following command:
More details on how to verify if the upgrade completed successfully can be found in the advisory.
The advisory also provides configuration-based mitigation if you are unable to upgrade your router at this time.
Netgear
Netgear has released an advisory stating that the following products are vulnerable to the DNSPooq dnsmaq vulnerabilities:
- RAX40 running firmware versions prior to v1.0.3.88
- RAX35 running firmware versions prior to v1.0.3.88
Netgear owners can download updated firmware for these products from the NETGEAR Support section.
Red Hat
Red Hat released an advisory today offering mitigation advice for various versions of Red Hat Enterprise Linux.
It is possible to mitigate the vulnerabilities in Red Hat 8.3 using dnsmasq configuration options. However, earlier versions require you to update the dnsmasq package.
Siemens
Siemens has released a security advisory that states the RuggedCom RM1224 and various Scalance versions are affected by the DNSPooq vulnerabilities.
Updates are not available yet, but Siemens has provided mitigations that can be applied to the devices to reduce the risk.
Sophos
Mac Software Updates In Order
Sophos' advisory states that their Sophos RED product is affected by the DNSPooq vulnerability. Sophos states that updated Sophos RED firmware for XG Firewall and SG UTM will be available soon.
Synology
Synology has released a security advisory stating that their DiskStation Manager (DSM) and Synology Router Manager (SRM) operating systems are only vulnerable to the DNSPooq DNS cache poisoning vulnerabilities (CVE-2020-25684, CVE-2020-25685 and CVE-2020-25686).
'None of Synology's products are affected by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683 and CVE-2020-25687 as these vulnerabilities only affect when DNSSEC is compiled,' Synology's advisory explains about the other vulnerabilities.
Versiontracker Mac Software Updates
The vulnerabilities in SRM 1.2 are resolved in version 1.2.4-8081-2 or above. A fix is not available yet for DSM 6.2.
Ubuntu
Mac Software Versions
Ubuntu has issued an advisory listing available packages for Ubuntu 16.04, 18.04, 20.04, and 20.10 that resolve the vulnerability.
It should be noted that 'after a standard system update you need to reboot your computer to make all the necessary changes.'
Related Articles:
- Version 16.0.5 English – Mac OS X 10.8 – 10.11 [Download]41.5MB
- Version 15.0.7 E/G/J – Mac OS 10.6.8 – 10.8 [Download] 74.8MB
- Version 15.0.4 E/G/J/C – Mac OS 10.5 [Download] 103.4MB
- Version 13.0.3 (Deluxe 2009) English [Download] 64.7MB
- Version 13.0.3 (Deluxe 2009) E/F/G/J/C [Download] 100.7MB
- Version 12.0.2 French [Download] 61.7MB
- Version 12.0.2 German [Download] 61.7MB
- Version 12.0.2 Japanese [Download] 62.2MB
- Version 12.0.2 Chinese [Download] 62.2MB
- Version 11.0.2 English [Download] 62.2MB
IMPORTANT NOTE: This update INCLUDES the StuffItCM.plugin
- Version 10.0.2 English [Download] 22.7MB
- Version 10.0.1 French [Download] 36MB
- Version 10.0.1 German [Download] 32.2MB
- Version 9.0.2 English [Download] 1.5MB
IMPORTANT NOTE: This will only work if you have StuffIt Deluxe 9.0.1 installed. In addition, once updated, the version number displayed for the application will not change to 9.0.2, but the appropriate component parts will be updated.
- Version 9.0.1 English [Download] 15.9MB
- Version 9.0.1 German [Download] 21.5MB
- Version 9.0.1 French [Download] 21.4MB
- Version 9.0.1 Japanese [Download] 21.9MB
- Version 8.0.2 English [Download] 13.7MB