Mandriva Linux Security Advisory : dnsmasq (MDVSA-2013:072)

Medium Nessus Plugin ID 66086


The remote Mandriva Linux host is missing one or more security updates.


Updated dnsmasq packages fix security vulnerabilities :

When dnsmasq before 2.63 is used in conjunctions with certain configurations of libvirtd, network packets from prohibited networks (e.g. packets that should not be passed in) may be sent to the dnsmasq application and processed. This can result in DNS amplification attacks for example (CVE-2012-3411).

This update adds a new option --bind-dynamic which is immune to this problem.

Updated dnsmasq packages fix security vulnerabilities (CVE-2013-0198) :

This update completes the fix for CVE-2012-3411 provided with dnsmasq-2.63. It was found that after the upstream patch for CVE-2012-3411 issue was applied, dnsmasq still :

- replied to remote TCP-protocol based DNS queries (UDP protocol ones were corrected, but TCP ones not) from prohibited networks, when the --bind-dynamic option was used,

- when --except-interface lo option was used dnsmasq didn't answer local or remote UDP DNS queries, but still allowed TCP protocol based DNS queries,

- when --except-interface lo option was not used local / remote TCP DNS queries were also still answered by dnsmasq.

This update fix these three cases.


Update the affected dnsmasq and / or dnsmasq-base packages.

Plugin Details

Severity: Medium

ID: 66086

File Name: mandriva_MDVSA-2013-072.nasl

Version: $Revision: 1.4 $

Type: local

Published: 2013/04/20

Modified: 2014/06/26

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:ND

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:dnsmasq, p-cpe:/a:mandriva:linux:dnsmasq-base, cpe:/o:mandriva:business_server:1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2013/04/08

Reference Information

CVE: CVE-2012-3411, CVE-2013-0198

BID: 54353, 57458

MDVSA: 2013:072

MGASA: 2012-0273, 2013-0030