CVE-2021-3448

Katalog CVE

CVSS 4.0 · Medium EPSS 2,3%

Kerentanan Improperly Implemented Security Check for Standard pada thekelleys dnsmasq, redhat enterprise linux +2 lainnya. Skor CVSS 3.1 4.0 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.

Rincian

Terbit di NVD

8 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.0 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-358: Improperly Implemented Security Check for Standard

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1939368 exploit · issue tracking · patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://security.gentoo.org/glsa/202105-20 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVTJUOFFFHINL...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHG7GWSQWKF7J...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GHURNEHHUBSW4...