SB2025032950 - Anolis OS update for dnsmasq
Published: March 29, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2023-50387)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.
2) Resource exhaustion (CVE-ID: CVE-2023-50868)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.
3) Insufficient verification of data authenticity (CVE-ID: CVE-2021-3448)
The vulnerability allows a remote attacker to perform a DNS Cache Poisoning attack.
The vulnerability exists due to dnsmasq relies only on transmission ID when processing DNS queries and uses the same port for outgoing requests, when configured to given network interface. A remote attacker can guess the random transmission ID to forge a reply and get it accepted by dnsmasq.As a result, an attacker can perform a DNS Cache Poisoning attack.
Remediation
Install update from vendor's website.