CVE-2021-3448

Se encontró un fallo en dnsmasq en versiones anteriores a 2.85. Cuando es configurado para usar un servidor específico para una interfaz de red determinada, dnsmasq usa un puerto fijado para enviar consultas. Un atacante en la red, capaz de encontrar el puerto de salida usado por dnsmasq, solo necesita adivinar la ID de transmisión aleatoria para falsificar una respuesta y lograr que dnsmasq la acepte. Este fallo hace que un ataque de envenenamiento de caché de DNS sea mucho más fácil. La mayor amenaza de esta vulnerabilidad es la integridad de los datos

A flaw was found in dnsmasq. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.

USN-4976-1 fixed a vulnerability in Dnsmasq. This update provides the corresponding update for Ubuntu 16.04 ESM. Dnsmasq has been updated to 2.79-1 for Ubuntu 16.04 ESM in order to fix some security issues. Petr Mensik discovered that Dnsmasq incorrectly randomized source ports in certain configurations. A remote attacker could possibly use this issue to facilitate DNS cache poisoning attacks.