Description
dnsmasq 2.43 allows remote attackers to cause a denial of service (daemon crash) by (1) sending a DHCPINFORM while lacking a DHCP lease, or (2) attempting to renew a nonexistent DHCP lease for an invalid subnet as an "unknown client," a different vulnerability than CVE-2008-3214.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dnsmasq | 2.44-1 | — |
| Debian 13 | dnsmasq | 2.44-1 | — |
| Debian 12 | dnsmasq | 2.44-1 | — |
References
- dnsmasq-dhcpinform-dos(43960) vdb-entry
- dnsmasq-dhcplease-dos(43957) vdb-entry
- [dnsmasq-discuss] 20080720 dnsmasq 2.44 available. mailing-list
- http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
- 31197 third-party-advisory
- ADV-2008-2166 vdb-entry