Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 585280 (CVE-2015-8899) - <net-dns/dnsmasq-2.76: Denial-of-service when empty address from DNS overlays A record from hosts (CVE-2015-8899)
Summary: <net-dns/dnsmasq-2.76: Denial-of-service when empty address from DNS overlays...
Status: RESOLVED FIXED
Alias: CVE-2015-8899
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-06-07 12:21 UTC by Agostino Sarubbo
Modified: 2016-07-17 00:48 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-06-07 12:21:09 UTC
From ${URL} :

A vulnerability was found in dmsmasq. A Denial-of-service will occur when an A or AAAA record is 
defined locally, in a hosts file, and an upstream server sends a reply that the same name is empty.

Upstream bug:

http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html

Upstream fix:

http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=41a8d9e99be9f2cc8b02051dd322cb45e0faac87


@maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
Comment 1 Patrick McLean gentoo-dev 2016-06-07 17:25:34 UTC
Sure, dnsmasq-2.76 can be stabilized.
Comment 2 Felix Janda 2016-07-02 09:52:35 UTC
ping
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2016-07-02 11:18:41 UTC
CVE-2015-8899 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8899):
  Dnsmasq before 2.76 allows remote servers to cause a denial of service
  (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA
  record defined locally.
Comment 4 Aaron Bauman (RETIRED) gentoo-dev 2016-07-02 11:20:53 UTC
@arches, please stabilize:

=net-dns/dnsmasq-2.76
Comment 5 Agostino Sarubbo gentoo-dev 2016-07-02 12:42:29 UTC
amd64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2016-07-02 12:43:13 UTC
x86 stable
Comment 7 Jeroen Roovers (RETIRED) gentoo-dev 2016-07-03 10:02:37 UTC
Stable for HPPA PPC64.
Comment 8 Tobias Klausmann (RETIRED) gentoo-dev 2016-07-04 11:20:19 UTC
Stable on alpha.
Comment 9 Markus Meier gentoo-dev 2016-07-05 20:59:15 UTC
arm stable
Comment 10 Agostino Sarubbo gentoo-dev 2016-07-08 07:59:17 UTC
ppc stable
Comment 11 Agostino Sarubbo gentoo-dev 2016-07-08 10:07:48 UTC
sparc stable
Comment 12 Agostino Sarubbo gentoo-dev 2016-07-08 12:07:00 UTC
ia64 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 14 Aaron Bauman (RETIRED) gentoo-dev 2016-07-17 00:48:17 UTC
GLSA Vote: No.