Secunia

Two vulnerabilities have been reported in Dnsmasq, which can be exploited by malicious people to cause a DoS (Denial of Service) or poison the DNS cache.

1) An off-by-one boundary error when reading the DHCP lease file can be exploited by a malicious DHCP client to cause a buffer overflow by supplying an overly long hostname and client-id.

Successful exploitation crashes Dnsmasq the next time it is started.

2) When receiving DNS replies, only the 16-bit ID is checked against the current query. This can be exploited to poison the DNS cache if a valid ID (randomly generated) is guessed by e.g. sending a flood of DNS replies.

Solution
Update to version 2.21.
Further details available in Customer Area

Provided and/or discovered by
1) The vendor credits Rob Holland.
2) Reported by vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://www.thekelleys.org.uk/dnsmasq/CHANGELOG

Deep Links
Links available in Customer Area