Test ID:	1.3.6.1.4.1.25623.1.0.703251
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-3251-1)
Summary:	The remote host is missing an update for the Debian 'dnsmasq' package(s) announced via the DSA-3251-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'dnsmasq' package(s) announced via the DSA-3251-1 advisory. Vulnerability Insight: Nick Sampanis discovered that dnsmasq, a small caching DNS proxy and DHCP/TFTP server, did not properly check the return value of the setup_reply() function called during a TCP connection, which is used then as a size argument in a function which writes data on the client's connection. A remote attacker could exploit this issue via a specially crafted DNS request to cause dnsmasq to crash, or potentially to obtain sensitive information from process memory. For the oldstable distribution (wheezy), this problem has been fixed in version 2.62-3+deb7u2. For the stable distribution (jessie), this problem has been fixed in version 2.72-3+deb8u1. For the testing distribution (stretch) and the unstable distribution (sid), this problem will be fixed soon. We recommend that you upgrade your dnsmasq packages. Affected Software/OS: 'dnsmasq' package(s) on Debian 7, Debian 8. Solution: Please install the updated package(s). CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-3294 BugTraq ID: 74452 http://www.securityfocus.com/bid/74452 Bugtraq: 20150423 Dnsmasq 2.72 Unchecked returned value (Google Search) http://www.securityfocus.com/archive/1/535354/100/1100/threaded Debian Security Information: DSA-3251 (Google Search) http://www.debian.org/security/2015/dsa-3251 https://security.gentoo.org/glsa/201512-01 http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009387.html http://www.securitytracker.com/id/1032195 SuSE Security Announcement: openSUSE-SU-2015:0857 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-05/msg00013.html http://www.ubuntu.com/usn/USN-2593-1
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.