Nom du paquet
dnsmasq
Date
2013-04-08
Advisory ID
MDVSA-2013:072
Affected versions
MBS1 x86_64

Problem description

Updated dnsmasq packages fix security vulnerabilities:

When dnsmasq before 2.63 is used in conjunctions with certain
configurations of libvirtd, network packets from prohibited networks
(e.g. packets that should not be passed in) may be sent to the dnsmasq
application and processed. This can result in DNS amplification
attacks for example (CVE-2012-3411).

This update adds a new option --bind-dynamic which is immune to
this problem.

Updated dnsmasq packages fix security vulnerabilities (CVE-2013-0198):

This update completes the fix for CVE-2012-3411 provided with
dnsmasq-2.63. It was found that after the upstream patch for
CVE-2012-3411 issue was applied, dnsmasq still:

- replied to remote TCP-protocol based DNS queries (UDP protocol
ones were corrected, but TCP ones not) from prohibited networks,
when the --bind-dynamic option was used,

- when --except-interface lo option was used dnsmasq didn't answer
local or remote UDP DNS queries, but still allowed TCP protocol based
DNS queries,

- when --except-interface lo option was not used local / remote TCP
DNS queries were also still answered by dnsmasq.

This update fix these three cases.

Updated packages

MBS1 x86_64

 89bdd7af8963a0c0e51a52b5b08295b0  mbs1/x86_64/dnsmasq-2.63-1.mbs1.x86_64.rpm
 1b45290efb8694734cfa1616b5ef6294  mbs1/x86_64/dnsmasq-base-2.63-1.mbs1.x86_64.rpm 
 8782b678c40e2c8ccedb39f60e2b6f0d  mbs1/SRPMS/dnsmasq-2.63-1.mbs1.src.rpm

References