REDHAT-BUG-1851342: Medium severity Red Hat dnsmasq vulnerability
dnsmasq, as shipped with Fedora and Red Hat Enterprise Linux, has a default configuration that makes it listen on any interface and accept queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Users that enable dnsmasq on their system with its default configuration may inadvertently make it an open resolver accessible from any address on the internet, potentially being involved in Distributed Denial of Service (DDoS) attacks against a victim.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1851342?
The severity of REDHAT-BUG-1851342 is considered high due to its potential for unauthorized external access.
How do I fix REDHAT-BUG-1851342?
To fix REDHAT-BUG-1851342, users should modify the dnsmasq configuration to enable the 'local-service' option.
Which systems are affected by REDHAT-BUG-1851342?
REDHAT-BUG-1851342 affects dnsmasq as shipped with Fedora and Red Hat Enterprise Linux.
What risks are associated with REDHAT-BUG-1851342?
The main risk of REDHAT-BUG-1851342 is that it allows dnsmasq to accept DNS queries from outside the local subnet, leading to potential data exposure.
Is there a workaround for REDHAT-BUG-1851342?
A temporary workaround for REDHAT-BUG-1851342 is to restrict dnsmasq to listen only on the local interface.