Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 3 Jul 2008 13:49:53 -0400
From: Jamie Strandboge <jamie@...onical.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com, Jamie Strandboge <jamie@...onical.com>
Subject: Re: CVE request for dnsmasq DoS

On Tue, 01 Jul 2008, Steven M. Christey wrote:

> 
> On Mon, 30 Jun 2008, Jamie Strandboge wrote:
> 
> > Hi,
> >
> > There is a remote DoS in dnsmasq 2.25 (and presumably earlier) that is
> > fixed in 2.26. Details can be found at [1]. Can we get a CVE assigned
> > for this?
> 
> I'm not sure I fully understand Thierry Carrez' comment about the security
> implications of this issue.  It seems like an exploit would require a
> malicious DHCP server, in which case isn't DHCP service already
> compromised?  If so, then a crash of dnsmasq (null dereference?) doesn't
> seem to be any worse than the loss of DHCP itself.
> 
I haven't had time to develop a PoC, but from the dnsmasq 2.26 announce
page at [1], a client need only send a crafted renewal request to crash
the server. Thierry's comments were only for trying to reproduce the
problem and test the patch.

Jamie

[1] http://freshmeat.net/projects/dnsmasq/?branch_id=1991&release_id=217681

-- 
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ