USN-2593-1: Dnsmasq vulnerability

Ubuntu Security Notice USN-2593-1

4th May, 2015

dnsmasq vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu (vivid)
• Ubuntu 14.10
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

Dnsmasq could be made to crash or expose sensitive information if it received specially crafted network traffic.

Software description

• dnsmasq - Small caching DNS proxy and DHCP/TFTP server

Details

Nick Sampanis discovered that Dnsmasq incorrectly handled certain malformed
DNS requests. A remote attacker could use this issue to cause Dnsmasq to
crash, resulting in a denial of service, or possibly obtain sensitive
information.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu (vivid):

dnsmasq-base 2.72-3ubuntu0.1

Ubuntu 14.10:

dnsmasq-base 2.71-1ubuntu0.1

Ubuntu 14.04 LTS:

dnsmasq-base 2.68-1ubuntu0.1

Ubuntu 12.04 LTS:

dnsmasq 2.59-4ubuntu0.2

dnsmasq-utils 2.59-4ubuntu0.2

dnsmasq-base 2.59-4ubuntu0.2

To update your system, please follow these instructions: http://ift.tt/17VXqjU.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2015-3294

from Ubuntu Security Notices http://ift.tt/1IGxLxj