Input validation error in Dnsmasq - CVE-2013-0198

Vulnerability details

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (traffic amplification) via spoofed TCP based DNS queries.

Affected software

How to mitigate CVE-2013-0198

External References

• https://bugzilla.redhat.com/show_bug.cgi?id=894486
• http://www.openwall.com/lists/oss-security/2013/01/18/7
• http://www.openwall.com/lists/oss-security/2013/01/18/2
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:072
• http://www.thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commitdiff%3Bh=22ce550e5346947a12a781ed0959a7b1165d0dc6

Related Security Bulletins

• Input validation error in Dnsmasq
• Gentoo update for Dnsmasq