The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt+dnsmasq: DNS configured to answer DNS queries from non-virtual networks (CVE-2012-3411)

  - dnsmasq: unchecked return value of the setup_reply() function (CVE-2015-3294)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dnsmasq: unchecked return value of the setup_reply() function (CVE-2015-3294)

  - dnsmasq: insecure default configuration makes it an open resolver (CVE-2020-14312)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - dnsmasq: unchecked return value of the setup_reply() function (CVE-2015-3294)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This update for dnsmasq fixes the following security issues :

  - CVE-2017-14491: 2 byte heap based overflow.
    [bsc#1060354]

  - CVE-2017-14492: heap based overflow. [bsc#1060355]

  - CVE-2017-14493: stack based overflow. [bsc#1060360]

  - CVE-2017-14494: DHCP - info leak. [bsc#1060361]

  - CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]

  - CVE-2017-14496: DNS - DoS Integer underflow.
    [bsc#1060364] This update brings a (small) potential     incompatibility in the handling of 'basename' in
    --pxe-service. Please read the CHANGELOG and the     documentation if you are using this option.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dnsmasq fixes the following issues. Remedy the following security issues :

  - CVE-2017-14491: 2 byte heap based overflow.
    [bsc#1060354]

  - CVE-2017-14492: heap based overflow. [bsc#1060355]

  - CVE-2017-14493: stack based overflow. [bsc#1060360]

  - CVE-2017-14494: DHCP - info leak. [bsc#1060361]

  - CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]

  - CVE-2017-14496: DNS - DoS Integer underflow.
    [bsc#1060364]

  - Prevent a man-in-the-middle attack (bsc#972164,     fate#321175). Furthermore, the following issues have     been fixed :

  - Fix DHCP relaying, broken in 2.76 and 2.77.

  - Update to version 2.78 (fate#321175, fate#322030,     bsc#1035227).

  - Fix PXE booting for UEFI architectures (fate#322030).

  - Drop PrivateDevices=yes which breaks logging     (bsc#902511, bsc#904537)

  - Build with support for DNSSEC (fate#318323, bsc#908137).
    Please note that this update brings a (small) potential     incompatibility in the handling of 'basename' in
    --pxe-service. Please read the CHANGELOG and the     documentation if you are using this option.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the dnsmasq package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Dnsmasq is lightweight, easy to configure DNS forwarder     and DHCP server. It is designed to provide DNS and,     optionally, DHCP, to a small network. It can serve the     names of local machines which are not in the global     DNS. The DHCP server integrates with the DNS server and     allows machines with DHCP-allocated addresses to appear     in the DNS with names configured either in each host or     in a central configuration file. Dnsmasq supports     static and dynamic DHCP leases and BOOTP for network     booting of diskless machines.

  - Security Fix(es)

  - The tcp_request function in Dnsmasq before 2.73rc4 does     not properly handle the return value of the setup_reply     function, which allows remote attackers to read process     memory and cause a denial of service (out-of-bounds     read and crash) via a malformed DNS     request.(CVE-2015-3294)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote dnsmasq server is running a version prior to 2.73rc4. It is, therefore, affected by an information disclosure vulnerability due not properly checking the return value from the setup_reply() function during TCP connections. An unauthenticated, remote attacker can exploit this to disclose sensitive information.

The remote host is affected by the vulnerability described in GLSA-201512-01 (Dnsmasq: Denial of Service)

    An out-of-bounds read vulnerability has been found in the tcp_request       function in Dnsmasq.
  Impact :

    A remote attacker could send a specially crafted DNS request, possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The DNS server dnsmasq was updated to fix one security issue and one non-security bug :

CVE-2015-3294: A remote unauthenticated attacker could have caused a denial of service (DoS) or read memory from the heap, potentially disclosing information such as performed DNS queries or encryption keys. (bsc#928867)

bsc#923144: When answer to an upstream query is a CNAME pointing to an A/AAAA record which is present locally (/etc/hosts), allow caching when the upstream and local A/AAAA records have the same value.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The DNS server dnsmasq was updated to fix one security issue and one non-security bug.

The following vulnerability was fixed :

  - CVE-2015-3294: A remote unauthenticated attacker could     have caused a denial of service (DoS) or read heap     memory, potentially disclosing information such as     performed DNS queries or encryption keys. (bsc#928867)

The following bug was fixed :

  - bsc#923144: When answer to an upstream query is a CNAME     pointing to an A/AAAA record which is present locally     (/etc/hosts), allow caching when the upstream and local     A/AAAA records have the same value.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as :

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.'

The following vulnerability vulnerability was found in dnsmasq :

CVE-2015-3294

Remote attackers could read process memory and cause DoS via malformed DNS requests.

For Debian 6 'Squeeze', these issues have been fixed in dnsmasq version 2.55-2+deb6u1.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The DNS server dnsmasq was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-3294: A remote unauthenticated attacker could     have caused a denial of service (DoS) or read heap     memory, potentially disclosing information such as     performed DNS queries or encryption keys. (bsc#928867)

Nick Sampanis discovered that dnsmasq, a small caching DNS proxy and DHCP/TFTP server, did not properly check the return value of the setup_reply() function called during a TCP connection, which is used then as a size argument in a function which writes data on the client's connection. A remote attacker could exploit this issue via a specially crafted DNS request to cause dnsmasq to crash, or potentially to obtain sensitive information from process memory.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2593-1 advisory.

    Nick Sampanis discovered that Dnsmasq incorrectly handled certain malformed DNS requests. A remote     attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service, or possibly     obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198995	RHEL 5 : dnsmasq (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198892	RHEL 7 : dnsmasq (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198890	RHEL 6 : dnsmasq (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
103640	SUSE SLES11 Security Update : dnsmasq (SUSE-SU-2017:2619-1)	Nessus	SuSE Local Security Checks	critical
103638	SUSE SLES11 Security Update : dnsmasq (SUSE-SU-2017:2617-1)	Nessus	SuSE Local Security Checks	critical
103637	SUSE SLES12 Security Update : dnsmasq (SUSE-SU-2017:2616-1)	Nessus	SuSE Local Security Checks	critical
99807	EulerOS 2.0 SP1 : dnsmasq (EulerOS-SA-2016-1044)	Nessus	Huawei Local Security Checks	medium
87596	dnsmasq < 2.73rc4 setup_reply() Function Return Value Checking Information Disclosure	Nessus	DNS	medium
87484	GLSA-201512-01 : Dnsmasq: Denial of Service	Nessus	Gentoo Local Security Checks	medium
84081	SUSE SLED11 / SLES11 Security Update : dnsmasq (SUSE-SU-2015:1015-1)	Nessus	SuSE Local Security Checks	medium
83948	SUSE SLED12 / SLES12 Security Update : dnsmasq (SUSE-SU-2015:0979-1)	Nessus	SuSE Local Security Checks	medium
83793	FreeBSD : dnsmasq -- data exposure and denial of service (37569eb7-0125-11e5-9d98-080027ef73ec)	Nessus	FreeBSD Local Security Checks	medium
83747	Debian DLA-225-1 : dnsmasq security update	Nessus	Debian Local Security Checks	medium
83398	openSUSE Security Update : dnsmasq (openSUSE-2015-359)	Nessus	SuSE Local Security Checks	medium
83253	Debian DSA-3251-1 : dnsmasq - security update	Nessus	Debian Local Security Checks	medium
83252	Ubuntu 14.04 LTS : Dnsmasq vulnerability (USN-2593-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2015-3294

critical

Tenable Plugins

high

medium

critical

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical