Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 453170 (CVE-2013-0198) - <net-dns/dnsmasq-2.66: Incomplete fix for the CVE-2012-3411 issue (CVE-2013-0198)
Summary: <net-dns/dnsmasq-2.66: Incomplete fix for the CVE-2012-3411 issue (CVE-2013-0...
Status: RESOLVED FIXED
Alias: CVE-2013-0198
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-01-20 13:31 UTC by Agostino Sarubbo
Modified: 2014-06-25 21:59 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-01-20 13:31:28 UTC
From $URL :

  the CVE-2012-3411 identifier has been originally assigned to the
following issue:

When dnsmasq is used in conjunctions with certain configurations of libvirtd, network packets from 
prohibited networks (e.g. packets that should not be passed in) may be sent to the dnsmasq 
application and processed. This can result in DNS amplification attacks for example.
[1] http://www.openwall.com/lists/oss-security/2012/07/12/5

Later it was found:
[2] https://bugzilla.redhat.com/show_bug.cgi?id=894486
[3] https://bugzilla.redhat.com/show_bug.cgi?id=894486#c3

the upstream patch for CVE-2012-3411 it not to be working properly,
as it still allowed (from [3]):

* replies to remote TCP-protocol based DNS queries
(UDP protocol ones were corrected, but TCP ones not)
from prohibited networks, when the --bind-dynamic option was used,

* when --except-interface lo option was used dnsmasq didn't
answer local or remote UDP DNS queries, but still allowed
TCP protocol based DNS queries,

* when --except-interface lo option was not used local / remote
TCP DNS queries were also still answered by dnsmasq.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2013-03-06 23:58:23 UTC
CVE-2013-0198 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0198):
  Dnsmasq before 2.66test2, when used with certain libvirt configurations,
  replies to queries from prohibited interfaces, which allows remote attackers
  to cause a denial of service (traffic amplification) via spoofed TCP based
  DNS queries.  NOTE: this vulnerability exists because of an incomplete fix
  for CVE-2012-3411.
Comment 2 Patrick McLean gentoo-dev 2013-03-07 00:50:35 UTC
I will pull in 2.66 final when it comes out with the fix, unless someone submits a separated patch that applies against 2.65.
Comment 3 Patrick McLean gentoo-dev 2013-04-19 17:32:47 UTC
net-dns/dnsmasq-2.66 is now in the tree containing the fix for this
Comment 4 Sean Amoss gentoo-dev Security 2013-04-19 18:30:27 UTC
(In reply to comment #3)
> net-dns/dnsmasq-2.66 is now in the tree containing the fix for this

And ready to go stable?
Comment 5 Patrick McLean gentoo-dev 2013-05-09 00:16:12 UTC
Yeah it's ready to go stable. Sorry about the delay in responding here.
Comment 6 Sean Amoss gentoo-dev Security 2013-05-09 17:36:49 UTC
Arches, please test and mark stable:
=net-dns/dnsmasq-2.66
Target KEYWORDS: "alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sh sparc x86 ~sparc-fbsd ~x86-fbsd"
Comment 7 Jeroen Roovers gentoo-dev 2013-05-10 15:23:18 UTC
Stable for HPPA.
Comment 8 Agostino Sarubbo gentoo-dev 2013-05-11 10:38:23 UTC
amd64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2013-05-11 11:03:05 UTC
x86 stable
Comment 10 Agostino Sarubbo gentoo-dev 2013-05-11 11:07:32 UTC
alpha stable
Comment 11 Agostino Sarubbo gentoo-dev 2013-05-11 11:08:45 UTC
arm stable
Comment 12 Agostino Sarubbo gentoo-dev 2013-05-11 11:09:52 UTC
ia64 stable
Comment 13 Agostino Sarubbo gentoo-dev 2013-05-11 11:10:49 UTC
ppc64 stable
Comment 14 Agostino Sarubbo gentoo-dev 2013-05-11 11:11:33 UTC
ppc stable
Comment 15 Agostino Sarubbo gentoo-dev 2013-05-11 11:13:03 UTC
sparc stable
Comment 16 Agostino Sarubbo gentoo-dev 2013-05-26 06:43:29 UTC
s390 stable
Comment 17 Agostino Sarubbo gentoo-dev 2013-06-09 16:02:18 UTC
sh stable
Comment 18 Sergey Popov gentoo-dev 2013-08-22 10:14:49 UTC
GLSA vote: yes
Comment 19 Alex Xu (Hello71) 2014-04-24 20:52:32 UTC
Poke, 8 months passed.
Comment 20 Yury German Gentoo Infrastructure gentoo-dev Security 2014-06-19 03:06:41 UTC
GLSA Vote: Yes
Created a New GLSA request.
Comment 21 GLSAMaker/CVETool Bot gentoo-dev 2014-06-25 21:59:34 UTC
This issue was resolved and addressed in
 GLSA 201406-24 at http://security.gentoo.org/glsa/glsa-201406-24.xml
by GLSA coordinator Mikle Kolyada (Zlogene).