dnsmasq < 2.93 Heap-Based Buffer Overflow (CVE-2026-12725)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(325896);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/10");

  script_cve_id("CVE-2026-12725");

  script_name(english:"dnsmasq < 2.93 Heap-Based Buffer Overflow (CVE-2026-12725)");

  script_set_attribute(attribute:"synopsis", value:
"The remote DNS / DHCP service is affected by a heap-based buffer overflow vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of dnsmasq installed on the remote host is prior to 2.93. It is, therefore, affected by a heap-based
buffer overflow vulnerability. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY
replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal
logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in
denial of service.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"http://www.thekelleys.org.uk/dnsmasq/CHANGELOG");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2026-12725");
  script_set_attribute(attribute:"solution", value:
"Upgrade to dnsmasq 2.93 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-12725");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/09");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:thekelleys:dnsmasq");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"DNS");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dns_version.nasl");
  script_require_keys("dns_server/version", "Settings/ParanoidReport");
  script_require_ports("Services/dns", 53);

  exit(0);
}

include('audit.inc');

var app_name = 'dnsmasq';
var port = get_kb_item('Services/udp/dns');

if (!port)
  port = 53;

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

# dnsmasq replies to BIND.VERSION
var version = tolower(get_kb_item_or_exit('dns_server/version'));
var display_version = version;

if (version !~ "dnsmasq-(v)?")
  audit(AUDIT_NOT_LISTEN, app_name, port);

version = preg_replace(pattern:"^dnsmasq-(v)?(.*)$", replace:"\2", string:version);

if (version == '2')
  audit(AUDIT_VER_NOT_GRANULAR, app_name, port, display_version);

var fix = '2.93';
if (ver_compare(ver:version, fix:fix, strict:FALSE) >= 0)
  audit(AUDIT_LISTEN_NOT_VULN, app_name, port, version, 'udp');

var report = '\n' +
         '\n  Installed version : ' + display_version +
         '\n  Fixed version     : dnsmasq-' + fix +
         '\n';

security_report_v4(port:port, proto:'udp', severity:SECURITY_HOLE, extra:report);