CVE-2008-3350 dnsmasq 2.43 allows remote attackers to cause a denial of service (daemon crash) by (1) sending a DHCPINFORM while lacking a DHCP lease, or (2) attempting to renew a nonexistent DHCP lease for an inva...
MediumCVSS 5.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dnsmasq 2.43 allows remote attackers to cause a denial of service (daemon crash) by (1) sending a DHCPINFORM while lacking a DHCP lease, or (2) attempting to renew a nonexistent DHCP lease for an invalid subnet as an "unknown client," a different vulnerability than CVE-2008-3214.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| the kelleys dnsmasq | = 2.43 | No fix listed |
| debian/dnsmasq(Debian:12) | < 2.44-1 | 2.44-1 |
| debian/dnsmasq(Debian:13) | < 2.44-1 | 2.44-1 |
| debian/dnsmasq(Debian:14) | < 2.44-1 | 2.44-1 |
References
- [dnsmasq-discuss] 20080720 dnsmasq 2.44 available. mailing-list patch
- 31197 third-party-advisory vendor-advisory
- www.thekelleys.org.uk
- ADV-2008-2166 vdb-entry
- dnsmasq-dhcplease-dos(43957) vdb-entry
- dnsmasq-dhcpinform-dos(43960) vdb-entry
- Debian Security Tracker CVE-2008-3350 vendor-advisory