Debian Security Advisory

DSA-3251-1 dnsmasq -- security update

Date Reported:
05 May 2015
Affected Packages:
Security database references:
In the Debian bugtracking system: Bug 783459.
In Mitre's CVE dictionary: CVE-2015-3294.
More information:

Nick Sampanis discovered that dnsmasq, a small caching DNS proxy and DHCP/TFTP server, did not properly check the return value of the setup_reply() function called during a TCP connection, which is used then as a size argument in a function which writes data on the client's connection. A remote attacker could exploit this issue via a specially crafted DNS request to cause dnsmasq to crash, or potentially to obtain sensitive information from process memory.

For the oldstable distribution (wheezy), this problem has been fixed in version 2.62-3+deb7u2.

For the stable distribution (jessie), this problem has been fixed in version 2.72-3+deb8u1.

For the testing distribution (stretch) and the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your dnsmasq packages.