Description
dnsmasq 2.25 allows remote attackers to cause a denial of service (daemon crash) by (1) renewing a nonexistent lease or (2) sending a DHCPREQUEST for an IP address that is not in the same network, related to the DHCP NAK response from the daemon.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dnsmasq | 2.26-1 | — |
| Debian 13 | dnsmasq | 2.26-1 | — |
| Debian 12 | dnsmasq | 2.26-1 | — |
References
- https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/47438
- [oss-security] 20080712 Re: CVE request for dnsmasq DoS mailing-list
- [oss-security] 20080708 Re: CVE request for dnsmasq DoS mailing-list
- dnsmasq-multiple-dos(43929) vdb-entry
- http://freshmeat.net/projects/dnsmasq/?branch_id=1991&release_id=217681
- [oss-security] 20080701 Re: CVE request for dnsmasq DoS mailing-list
- [oss-security] 20080630 CVE request for dnsmasq DoS mailing-list
- http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
- [oss-security] 20080702 Re: CVE request for dnsmasq DoS mailing-list
- [oss-security] 20080703 Re: CVE request for dnsmasq DoS mailing-list