SB2017100229 - Memory exhaustion in dnsmasq (Alpine package)

Description

This security bulletin contains information about 1 security vulnerability.

1) Memory exhaustion (CVE-ID: CVE-2017-14495)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect memory allocation (memory is never freed) in  add_pseudoheader() function when processing DNS queries. A remote unauthenticated attacker can send a specially crafted DNS request to the affected service and cause dnsmasq to consume all available memory.

Successful exploitation of this vulnerability may allow an attacker to perform a denial of service (DoS) attack, but requires that dnsmasq is compiled with --add-mac, --add-cpe-id or --add-subnet option.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=3640e0ea2d3be8fc17d71b9faad5a0b8806d7f78
• https://git.alpinelinux.org/aports/commit/?id=3afe33ad348010beb44371a68febd5f2f252299a
• https://git.alpinelinux.org/aports/commit/?id=43dd2c9dbd748d5b095ba9eec3da18255d5bd158
• https://git.alpinelinux.org/aports/commit/?id=e2b7176ff9d902f7e8837d4a7ef0d560c903fc35