dnsmasq 2.73rc6 < 2.73rc8 extract_name() Function RCE

critical Nessus Plugin ID 87593

Language:

New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote DNS / DHCP service is affected by a remote code execution vulnerability.

Description

The remote dnsmasq server is running version 2.73rc6 or 2.73rc7. It is, therefore, affected by a remote code execution vulnerability due to an overflow condition in the extract_name() function in rfc1035.c that occurs due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service or the execution of arbitrary code.

Solution

Upgrade to dnsmasq 2.73rc8 or later.

See Also

http://www.nessus.org/u?d8b0a30e

http://www.thekelleys.org.uk/dnsmasq/CHANGELOG

Plugin Details

Severity: Critical

ID: 87593

File Name: dnsmasq_bof-2_73_rc8.nasl

Version: 1.2

Type: remote

Family: DNS

Published: 12/22/2015

Updated: 8/10/2018

Dependencies: dns_version.nasl

Configuration: Enable paranoid mode

Risk Information

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:thekelleys:dnsmasq

Required KB Items: dns_server/version, Settings/ParanoidReport

Patch Publication Date: 5/15/2015

Vulnerability Publication Date: 5/15/2015