CVE-2013-0198 — Improper Input Validation in Dnsmasq

CWE-20 — Improper Input Validation8 documents7 sources
Severity
5.0MEDIUMNVD
EPSS
0.1%
top 84.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Thekelleys Dnsmasq
Timeline
PublishedMar 5
Latest updateMay 5

Description

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Debianthekelleys/dnsmasq< 2.66-1+3

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-3pxx-76hx-4rw2: Dnsmasq before 2↗2022-05-05
▶
OSV
CVE-2013-0198: Dnsmasq before 2↗2013-03-05
▶
CVEList
CVE-2013-0198: Dnsmasq before 2↗2013-03-04
▶

📋Vendor Advisories

2
Red Hat
dnsmasq: Incomplete fix for the CVE-2012-3411 issue↗2013-01-11
▶
Debian
CVE-2013-0198: dnsmasq - Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies...↗2013
▶

💬Community

2
Bugzilla
CVE-2013-0198 dnsmasq: Incomplete fix for the CVE-2012-3411 issue [fedora-all]↗2013-01-18
▶
Bugzilla
CVE-2013-0198 dnsmasq: Incomplete fix for the CVE-2012-3411 issue↗2013-01-11
▶
CVE-2013-0198 — Improper Input Validation in Dnsmasq | cvebase