- Package name
- Advisory ID
- Affected versions
- MBS1 x86_64
Updated dnsmasq packages fix security vulnerabilities:
When dnsmasq before 2.63 is used in conjunctions with certain
configurations of libvirtd, network packets from prohibited networks
(e.g. packets that should not be passed in) may be sent to the dnsmasq
application and processed. This can result in DNS amplification
attacks for example (CVE-2012-3411).
This update adds a new option --bind-dynamic which is immune to
Updated dnsmasq packages fix security vulnerabilities (CVE-2013-0198):
This update completes the fix for CVE-2012-3411 provided with
dnsmasq-2.63. It was found that after the upstream patch for
CVE-2012-3411 issue was applied, dnsmasq still:
- replied to remote TCP-protocol based DNS queries (UDP protocol
ones were corrected, but TCP ones not) from prohibited networks,
when the --bind-dynamic option was used,
- when --except-interface lo option was used dnsmasq didn't answer
local or remote UDP DNS queries, but still allowed TCP protocol based
- when --except-interface lo option was not used local / remote TCP
DNS queries were also still answered by dnsmasq.
This update fix these three cases.
89bdd7af8963a0c0e51a52b5b08295b0 mbs1/x86_64/dnsmasq-2.63-1.mbs1.x86_64.rpm 1b45290efb8694734cfa1616b5ef6294 mbs1/x86_64/dnsmasq-base-2.63-1.mbs1.x86_64.rpm 8782b678c40e2c8ccedb39f60e2b6f0d mbs1/SRPMS/dnsmasq-2.63-1.mbs1.src.rpm