Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS     packets that result in a read operation beyond the buffer allocated for the packet, a different     vulnerability than CVE-2017-14491. (CVE-2019-14513)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4924-1 advisory.

    It was discovered that Dnsmasq incorrectly handled certain wildcard synthesized NSEC records. A remote     attacker could possibly use this issue to prove the non-existence of hostnames that actually exist.
    (CVE-2017-15107)

    It was discovered that Dnsmasq incorrectly handled certain large DNS packets. A remote attacker could     possibly use this issue to cause Dnsmasq to crash, resulting in a denial of service. (CVE-2019-14513)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Samuel R Lovejoy discovered a security vulnerability in dnsmasq.
Carefully crafted packets by DNS servers might result in out of bounds read operations, potentially leading to a crash and denial of service.

For Debian 8 'Jessie', this problem has been fixed in version 2.72-3+deb8u5.

We recommend that you upgrade your dnsmasq packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254974	Linux Distros Unpatched Vulnerability : CVE-2019-14513	Nessus	Misc.	high
148938	Ubuntu 16.04 LTS : Dnsmasq vulnerabilities (USN-4924-1)	Nessus	Ubuntu Local Security Checks	high
128781	Debian DLA-1921-1 : dnsmasq security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-14513

high

Tenable Plugins

high

high

high