3 Dnsmasq Vulnerabilities Fixed in Ubuntu

Dnsmasq is a lightweight, easy-to-configure DNS forwarder and DHCP server commonly used in Linux distributions. It provides DNS caching and forwarding, DHCP services, router advertisement, and network booting. In recent updates, the Ubuntu security team has addressed three vulnerabilities in Dnsmasq, a widely used small caching DNS proxy and DHCP/TFTP server. These updates are crucial for ensuring the continued security and stability of systems running various Ubuntu releases, including Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04, and Ubuntu 16.04.

Dnsmasq Vulnerabilities in Ubuntu

Now, let’s delve into the details of these vulnerabilities and how the fixes mitigate potential risks.

CVE-2023-50387 (CVSS v3 Severity Score: 7.5 High)

This vulnerability (CVE-2023-50387) involves the incorrect handling of validating DNSSEC messages. It could potentially allow a remote attacker to cause a denial of service (CPU consumption) via one or more DNSSEC responses.

CVE-2023-50868

Another Dnsmasq vulnerability (CVE-2023-50868) revolves around the improper preparation of an NSEC3 closest encloser proof. In this scenario, a remote attacker could exploit this weakness to trigger resource consumption within Dnsmasq, ultimately resulting in a denial-of-service condition.

CVE-2023-28450 (CVSS v3 Severity Score: 7.5 High)

This vulnerability (CVE-2023-28450) is due to the misconfiguration of the maximum EDNS.0 UDP packet size, as mandated by DNS Flag Day 2020. It was found that the default maximum EDNS.0 UDP packet size was set to 4096 instead of 1232.

Mitigating the Risks

By exploiting these Dnsmasq vulnerabilities, attackers could disrupt network operations and compromise the availability of essential services. Users are strongly advised to apply security updates promptly to safeguard their systems against potential attacks. Remember, for end-of-life systems (Ubuntu 16.04 and Ubuntu 18.04), these updates are only available with Extended Security Maintenance (ESM) through Ubuntu Pro.

Instead of a costly Ubuntu Pro subscription, users can choose an affordable option, TuxCare’s Extended Lifecycle Support for patching their Ubuntu 16.04 and Ubuntu 18.04 systems. TuxCare offers vendor-grade security patches for an additional five years after the end date. For example, Ubuntu 18.04 reached the end of life on May 31, 2023, so TuxCare will provide security updates for Ubuntu 18.04 till 2028.

Source: USN-6657-1

Summary

Article Name

3 Dnsmasq Vulnerabilities Fixed in Ubuntu

Description

Explore the recent Dnsmasq vulnerabilities fixed by Ubuntu. Learn about potential risks and how to secure your Ubuntu systems.

Author

Rohan Timalsina

Publisher Name

TuxCare

Publisher Logo