CVE-2013-0198: Input Validation
Description of problem: On my workstation, as a virtual machine host, I have NetworkManager's dnsmasq configured to forward DNS queries for a local domain to 192.168.122.1, so I can resolve those to virtual machine DHCP hostnames. Recently this stopped working.
With manual dig commands, I found that TCP queries still work, but UDP doesn't. For example, in libvirt I have a statically defined name "vhost" to 192.168.122.1 itself. From the host, the command "dig +short +tcp @192.168.122.1 vhost" resolves that just fine. But "dig +short +notcp @192.168.122.1 vhost" says "connection timed out; no servers could be reached". From a guest, +tcp and +notcp both work fine.
Version-Release number of selected component (if applicable): libvirt-0.9.11.8-2.fc17.x8664, dnsmasq-2.63-1.fc17.x8664 I also tried dnsmasq-2.65-1.fc17.x8664 from updates-testing
How reproducible: 100%
Steps to Reproduce: 1. From the virtual machine host, try to query the libvirt dnsmasq. Actual results: $ dig +short +tcp @192.168.122.1 vhost 192.168.122.1 $ dig +short +notcp @192.168.122.1 vhost ;; connection timed out; no servers could be reached
Expected results: A positive answer from both TCP and UDP queries.
Additional info: I suspect this is related to the fixes for CVE-2012-3411, but it seems weird that UDP and TCP would be treated differently.
Other sources
Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0198?
CVE-2013-0198 has a severity level classified as high due to potential security implications in DNS configurations.
How do I fix CVE-2013-0198?
To fix CVE-2013-0198, update dnsmasq to version 2.66 or later to mitigate the vulnerability.
What systems are affected by CVE-2013-0198?
CVE-2013-0198 affects dnsmasq versions up to and including 2.65.
What type of vulnerability is CVE-2013-0198?
CVE-2013-0198 is a DNS-related vulnerability that can lead to DNS spoofing in specific configurations.
When was CVE-2013-0198 published?
CVE-2013-0198 was published on January 18, 2013.