Debian: New dnsmasq packages fix cache poisoning

    Date31 Jul 2008
    CategoryDebian
    3617
    Posted ByLinuxSecurity Advisories
    This update changes Debian's dnsmasq packages to implement the recommended countermeasure: UDP query source port randomization. This change increases the size of the space from which an attacker has to guess values in a backwards-compatible fashion and makes successful attacks significantly more difficult.
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1623-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                       Moritz Muehlenhoff
    July 31, 2008                         http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : dnsmasq
    Vulnerability  : DNS cache poisoning
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2008-1447
    
    Dan Kaminsky discovered that properties inherent to the DNS protocol
    lead to practical DNS cache poisoning attacks. Among other things,
    successful attacks can lead to misdirected web traffic and email
    rerouting.
    
    This update changes Debian's dnsmasq packages to implement the
    recommended countermeasure: UDP query source port randomization. This
    change increases the size of the space from which an attacker has to
    guess values in a backwards-compatible fashion and makes successful
    attacks significantly more difficult.
    
    This update also switches the random number generator to Dan
    Bernstein's SURF.
    
    For the stable distribution (etch), this problem has been fixed in
    version 2.35-1+etch4. Packages for alpha will be provided later.
    
    For the unstable distribution (sid), this problem has been fixed in
    version 2.43-1.
    
    We recommend that you upgrade your dnsmasq package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Stable updates are available for amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4.dsc
        Size/MD5 checksum:      596 3834461c89e55467b4b65ed4ac209e81
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35.orig.tar.gz
        Size/MD5 checksum:   252901 ad1fafeaf3442685cfe16613e0f8b777
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4.diff.gz
        Size/MD5 checksum:    19202 4ced7768f49198bd43bbbd24f2a3d3e4
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_amd64.deb
        Size/MD5 checksum:   188278 8fb55f694db9fdfccaa86d134e937777
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_arm.deb
        Size/MD5 checksum:   181746 4caf23f31de937b817e12ade7d132eac
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_hppa.deb
        Size/MD5 checksum:   190490 66730e785683655b058d11aa70346be4
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_i386.deb
        Size/MD5 checksum:   184546 1fbdd71e81a1e05d68b0f88eaeb00b10
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_ia64.deb
        Size/MD5 checksum:   223758 011f283b71ef0f9e07d5a9dce25db505
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_mips.deb
        Size/MD5 checksum:   189846 5c67cca2eaedc1dff80c5fd05aa1d33f
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_mipsel.deb
        Size/MD5 checksum:   191824 dfd87d69a7751f1e6ef2d0f1ede052ff
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_powerpc.deb
        Size/MD5 checksum:   186890 93701abcca5421beddab015a7f35af99
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_s390.deb
        Size/MD5 checksum:   186396 6f19f6c8d803c3d57e01e73fe1e11886
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.35-1+etch4_sparc.deb
        Size/MD5 checksum:   182910 f360078c14f715e90e60124b4ede2be9
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"23","type":"x","order":"1","pct":56.1,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":12.2,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"13","type":"x","order":"3","pct":31.71,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.