Dnsmasq and the seven flaws: Patch these nasty remote-control holes

@Phil Endecott - that was my first thought too, since dnsmasq is typically sitting at a network boundary.

Pretty sure openwrt uses dnsmasq, probably other open source firmwares too, and all those closed source routers that are probably never going to get an update.

Maybe Corps relying of this code should stump up some cash for dev time.

They like to launch their big packages on the world to gain kudos but ignore the small stuf they depend on.

An interesting issue for routers

Since dnsmasq services aren't exposed to the internet remote exploits to routers (whether commercial or open source) using it aren't a concern. The only way to exploit your router is for an attack to get code to run inside your network - via some type of browser based exploit, perhaps. But to what end? Once your router reboots, the malware will disappear - the malware can't rewrite individual binaries it would have to upload new firmware with all new binaries if it wanted to become a permanent resident on your router.

Configuring your router to reboot daily might be a good idea, to eliminate the chance of becoming part of some long lived botnet sending out spam or whatever an army of low performance devices is used for by black hats these days.

One someone can get remote code execution on your local devices, its game over. Its trivial to generate say a reverse shell tcp connection as part of that payload, and have it traverse a nat gateway, even wrap it up to look like normal web traffic or pick a common port (and since this is a dns attack, I'd be telling it to use 53 outbound since to forward it has to have that open). If the payload isnt large enough to support a full binary, its easy to generate a staged payload and boot strap in a larger component, or instruct the device to download the payload proper via its own means (wget, curl etc if installed).

A lot of people may say "oh they only have my router/print server/nas box, its ok", but no, what they have then is a really good foothold inside your permiter defences and a great point to further attack/enumerate your privileged lan.

As for how to make this a full remote exploit, it might take some creativity because on the surface you only answer queries from the local subnet to start with, but what if someone sends your client machines a email with urls, or they are redirected to a sequence of domains by a infected page or advert? will your local subnet dnsmasq server not get asked for those domains to be looked up if they look like domain names?

Patching the stuff I can thats affected as quick as I can here. You pays your money and takes your choice.

Remember, ne'er-do-wells think outside the box.

I've seen dnsmasq in small routers mostly.

I don't think people who made a few cents or $1 from selling a small router are going to be bothered updating their ROMs.

Hello.I have just ran a network scan with Avast,on my Win7 PC.It states my WDMC h/d & BT Smart Hub Router's Firmware (it states,it was updated 17th of Jan) needs updating & is vunerable.Could you please point me in the right direction,of finding out how to install a patch, to remedy this if possible.

Thanx