231282 2008-07-09 10:48 0000 net-dns/dnsmasq possibly affected by cache poisoning issue VU#800113 ? 2008-09-04 20:12:33 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2008q3/002147.html ?? [glsa] P2 normal --- 1 vorlon@gentoo.org security@gentoo.org arm@gentoo.org chutzpah@gentoo.org holger.hoffstaette@googlemail.com matt@xerq.net s390@gentoo.org sh@gentoo.org vorlon@gentoo.org 2008-07-09 10:48:49 0000 dnsmasq is probably affected by the cache poisoning issues too, see $URL chutzpah@gentoo.org 2008-07-09 18:25:50 0000 Yes, it does appear to be affected, I will update the version in portage as soon as a fix is out. chutzpah@gentoo.org 2008-07-09 21:49:00 0000 comitted net-dns/dnsmasq-2.43_rc3 which should have the fix (although it is unclear if dnsmasq is affected) http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2008q3/002148.html matt@xerq.net 2008-07-10 00:40:11 0000 I've tested both versions. I noticed that in the recently committed version that dnsmasq doesn't leave a high numbered UDP port open (in my case it was 32781) output of netstat -an | grep udp Version 2.42: udp 0 0 0.0.0.0:32781 0.0.0.0:* udp 0 0 0.0.0.0:53 0.0.0.0:* Version 2.43rc3: udp 0 0 0.0.0.0:53 0.0.0.0:* vorlon@gentoo.org 2008-07-11 14:50:04 0000 Arches, please test and mark stable: =net-dns/dnsmasq-2.43 Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86" jer@gentoo.org 2008-07-11 15:22:16 0000 Stable for HPPA. chutzpah@gentoo.org 2008-07-11 15:26:34 0000 stable on amd64 bluebird@gentoo.org 2008-07-11 15:50:38 0000 sparc stable armin76@gentoo.org 2008-07-11 16:22:53 0000 alpha/ia64/x86 stable corsair@gentoo.org 2008-07-12 14:24:21 0000 ppc64 stable dertobi123@gentoo.org 2008-07-13 17:25:46 0000 ppc stable py@gentoo.org 2008-07-13 19:25:24 0000 Since bind got a GLSA, I guess we'll have another one, but maybe we should combine with other DNS resolvers? Anyway, glsa reques filed. rbu@gentoo.org 2008-09-04 20:12:33 0000 GLSA 200809-02