CVE-2021-3448
Medium
Description
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.
SeverityMedium
CVSS4.0
Exploit probability83. percentile2.3%
Product
Thekelleys Dnsmasq
PublishedApr 8, 2021
First seenApr 8, 2021
Weakness typeCWE-358CWE-358
How to fix
Update
- thekelleys dnsmasq2.85 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GHURNEHHUBSW45KMIZ4FNBCSUPWPGV5V/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHG7GWSQWKF7JXIMLOGJBKZWBB4VIAJ7/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVTJUOFFFHINLKWAOC2ZSC5MOPD4SJ24/
- security.gentoo.org/glsa/202105-20
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thekelleys dnsmasq | v < 2.85 | 2.85 |
| redhat enterprise_linux | 8.0 | — |
| fedoraproject fedora | 32, 33, 34 | — |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 1.9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.