Bug 453170 (CVE-2013-0198) – <net-dns/dnsmasq-2.66: Incomplete fix for the CVE-2012-3411 issue (CVE-2013-0198)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Agostino Sarubbo 2013-01-20 13:31:28 UTC]

From $URL :

  the CVE-2012-3411 identifier has been originally assigned to the
following issue:

When dnsmasq is used in conjunctions with certain configurations of libvirtd, network packets from 
prohibited networks (e.g. packets that should not be passed in) may be sent to the dnsmasq 
application and processed. This can result in DNS amplification attacks for example.
[1] http://www.openwall.com/lists/oss-security/2012/07/12/5

Later it was found:
[2] https://bugzilla.redhat.com/show_bug.cgi?id=894486
[3] https://bugzilla.redhat.com/show_bug.cgi?id=894486#c3

the upstream patch for CVE-2012-3411 it not to be working properly,
as it still allowed (from [3]):

* replies to remote TCP-protocol based DNS queries
(UDP protocol ones were corrected, but TCP ones not)
from prohibited networks, when the --bind-dynamic option was used,

* when --except-interface lo option was used dnsmasq didn't
answer local or remote UDP DNS queries, but still allowed
TCP protocol based DNS queries,

* when --except-interface lo option was not used local / remote
TCP DNS queries were also still answered by dnsmasq.

[Comment 1 GLSAMaker/CVETool Bot 2013-03-06 23:58:23 UTC]

CVE-2013-0198 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0198):
  Dnsmasq before 2.66test2, when used with certain libvirt configurations,
  replies to queries from prohibited interfaces, which allows remote attackers
  to cause a denial of service (traffic amplification) via spoofed TCP based
  DNS queries.  NOTE: this vulnerability exists because of an incomplete fix
  for CVE-2012-3411.

[Comment 2 Patrick McLean 2013-03-07 00:50:35 UTC]

I will pull in 2.66 final when it comes out with the fix, unless someone submits a separated patch that applies against 2.65.

[Comment 3 Patrick McLean 2013-04-19 17:32:47 UTC]

net-dns/dnsmasq-2.66 is now in the tree containing the fix for this

[Comment 4 Sean Amoss (RETIRED) 2013-04-19 18:30:27 UTC]

(In reply to comment #3)
> net-dns/dnsmasq-2.66 is now in the tree containing the fix for this

And ready to go stable?

[Comment 5 Patrick McLean 2013-05-09 00:16:12 UTC]

Yeah it's ready to go stable. Sorry about the delay in responding here.

[Comment 6 Sean Amoss (RETIRED) 2013-05-09 17:36:49 UTC]

Arches, please test and mark stable:
=net-dns/dnsmasq-2.66
Target KEYWORDS: "alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sh sparc x86 ~sparc-fbsd ~x86-fbsd"

[Comment 7 Jeroen Roovers (RETIRED) 2013-05-10 15:23:18 UTC]

Stable for HPPA.

[Comment 8 Agostino Sarubbo 2013-05-11 10:38:23 UTC]

amd64 stable

[Comment 9 Agostino Sarubbo 2013-05-11 11:03:05 UTC]

x86 stable

[Comment 10 Agostino Sarubbo 2013-05-11 11:07:32 UTC]

alpha stable

[Comment 11 Agostino Sarubbo 2013-05-11 11:08:45 UTC]

arm stable

[Comment 12 Agostino Sarubbo 2013-05-11 11:09:52 UTC]

ia64 stable

[Comment 13 Agostino Sarubbo 2013-05-11 11:10:49 UTC]

ppc64 stable

[Comment 14 Agostino Sarubbo 2013-05-11 11:11:33 UTC]

ppc stable

[Comment 15 Agostino Sarubbo 2013-05-11 11:13:03 UTC]

sparc stable

[Comment 16 Agostino Sarubbo 2013-05-26 06:43:29 UTC]

s390 stable

[Comment 17 Agostino Sarubbo 2013-06-09 16:02:18 UTC]

sh stable

[Comment 18 Sergey Popov (RETIRED) 2013-08-22 10:14:49 UTC]

GLSA vote: yes

[Comment 19 Alex Xu (Hello71) 2014-04-24 20:52:32 UTC]

Poke, 8 months passed.

[Comment 20 Yury German 2014-06-19 03:06:41 UTC]

GLSA Vote: Yes
Created a New GLSA request.

[Comment 21 GLSAMaker/CVETool Bot 2014-06-25 21:59:34 UTC]

This issue was resolved and addressed in
 GLSA 201406-24 at http://security.gentoo.org/glsa/glsa-201406-24.xml
by GLSA coordinator Mikle Kolyada (Zlogene).