| Summary: | dnsmasq - Incomplete fix for the CVE-2012-3411 issue (CVE-2013-0198) | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Oden Eriksson <oe> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, julien.moragny, luigiwalser, sysadmin-bugs, tmb |
| Version: | 2 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0198 | ||
| Whiteboard: | has_procedure MGA2-64-OK MGA2-32-OK | ||
| Source RPM: | dnsmasq | CVE: | |
| Status comment: | |||
|
Description
Oden Eriksson
2013-01-23 19:13:08 CET
David Walser
2013-01-31 22:45:59 CET
CC:
(none) =>
julien.moragny, luigiwalser Hi, thanks for the report. I've just pushed dnsmasq-2.65-3.mga3 to cauldron with the patch from redhat to fix this CVE (here is the patch: https://bugzilla.redhat.com/show_bug.cgi?id=901555). I will prepare an update for mga2 ASAP. regards Julien
David Walser
2013-02-01 19:43:22 CET
Summary:
CVE-2013-0198: dnsmasq - Incomplete fix for the CVE-2012-3411 issue =>
dnsmasq - Incomplete fix for the CVE-2012-3411 issue (CVE-2013-0198) Here is the update for mga2, procedure for testing documented by Claire Robinson in bug #7466 : https://bugs.mageia.org/show_bug.cgi?id=7466#c9 Proposal of advisory: ======================== Updated dnsmasq packages fix security vulnerabilities (CVE-2013-0198): This update complete the fix for CVE-2012-3411 provided with dnsmasq-2.63. It was found that after the upstream patch for CVE-2012-3411 issue was applied, dnsmasq still: - replied to remote TCP-protocol based DNS queries (UDP protocol ones were corrected, but TCP ones not) from prohibited networks, when the --bind-dynamic option was used, - when --except-interface lo option was used dnsmasq didn't answer local or remote UDP DNS queries, but still allowed TCP protocol based DNS queries, - when --except-interface lo option was not used local / remote TCP DNS queries were also still answered by dnsmasq. This update fix these three cases. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0198 https://bugzilla.redhat.com/show_bug.cgi?id=901555 https://bugzilla.redhat.com/show_bug.cgi?id=894486 ======================== Updated packages in core/updates_testing: ======================== dnsmasq-2.63-1.1.mga2 dnsmasq-base-2.63-1.1.mga2 Source RPM: dnsmasq-2.63-1.1.mga2.src.rpm Hi QA, I just pushed an update of dnsmasq for mga2. You can find the advisory and a procedure to test in previous comments. Thank you regards Julien Status:
NEW =>
ASSIGNED Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=7466#c9 Whiteboard:
(none) =>
has_procedure Patch checked into Mageia 1 SVN. With dnsmasq-2.63-1.mga2 from Core Updates, I cannot reproduce the problem. Both of my virtualbox installs (one i586, and one x86_64) are responding to dig +notcp commands run from the host. Oden, how are you running the virtual systems? CC:
(none) =>
davidwhodgins I did only the reporting here. Ok. I'll go ahead and install the updates testing version, and just test that they are working properly. I noticed that when I installed the updates testing version, the dnsmasq service did not get restarted. Perhaps in future, automatic restarting could be added as an enhancement. Testing complete on Mageia 2 i586 and x86_64. Could someone from the sysadmin team push the srpm dnsmasq-2.63-1.1.mga2.src.rpm from Mageia 2 Core Updates Testing to Core Updates. Advisory: Updated dnsmasq packages fix security vulnerabilities (CVE-2013-0198): This update complete the fix for CVE-2012-3411 provided with dnsmasq-2.63. It was found that after the upstream patch for CVE-2012-3411 issue was applied, dnsmasq still: - replied to remote TCP-protocol based DNS queries (UDP protocol ones were corrected, but TCP ones not) from prohibited networks, when the --bind-dynamic option was used, - when --except-interface lo option was used dnsmasq didn't answer local or remote UDP DNS queries, but still allowed TCP protocol based DNS queries, - when --except-interface lo option was not used local / remote TCP DNS queries were also still answered by dnsmasq. This update fix these three cases. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0198 https://bugzilla.redhat.com/show_bug.cgi?id=901555 https://bugzilla.redhat.com/show_bug.cgi?id=894486 https://bugs.mageia.org/show_bug.cgi?id=8795 Keywords:
(none) =>
validated_update Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0030 Status:
ASSIGNED =>
RESOLVED |