PT-2013-2155 · Dnsmasq+1 · Dnsmasq+1

Josh Stone · Published 2013-03-04 · Updated 2023-02-13 · CVE-2013-0198

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Dnsmasq versions prior to 2.66test2

Description The issue allows remote attackers to cause a denial of service, specifically traffic amplification, via spoofed TCP-based DNS queries. This is possible when Dnsmasq is used with certain libvirt configurations and replies to queries from prohibited interfaces.

Recommendations For versions prior to 2.66test2, update to version 2.66test2 or later to resolve the issue. As a temporary workaround, consider restricting access to the DNS service to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-0198

Affected Products

Dnsmasq

Libvirt

References · 9

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=894486 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-0198 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0198 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-0198 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-0198 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:072 · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/01/18/7 · Note
• http://openwall.com/lists/oss-security/2013/01/18/2 · Note
• http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commitdiff%3Bh=22ce550e5346947a12a781ed0959a7b1165d0dc6 · Note