A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface dnsmasq uses a fixed port while forwarding queries. An attacker on the network able to find the outgoing port used by dnsmasq only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.

🗓️ 23 Apr 2021 07:00:00Reported by MicrosoftType

Dnsmasq flaw before 2.85 allows cache poisoning via fixed port and guessed transaction identifier.

Reporter	Title	Published	Views	Family All 129
ALT Linux	Security fix for the ALT Linux 10 package dnsmasq version 2.85-alt1	9 Apr 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package dnsmasq version 2.85-alt1	12 Apr 202100:00	–	altlinux
FreeBSD	dnsmasq -- cache poisoning vulnerability in certain configurations	17 Mar 202100:00	–	freebsd
Tenable Nessus	Alibaba Cloud Linux 3 : 0112: dnsmasq (ALINUX3-SA-2024:0112)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : dnsmasq (ALSA-2021:4153)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : dnsmasq (CESA-2021:4153)	11 Nov 202100:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.1 : dnsmasq (EulerOS-SA-2021-2189)	13 Jul 202100:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.0 : dnsmasq (EulerOS-SA-2021-2199)	13 Jul 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : dnsmasq (EulerOS-SA-2021-2242)	9 Aug 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : dnsmasq (EulerOS-SA-2021-2268)	9 Aug 202100:00	–	nessus