Open Resolver Vulnerability in Dnsmasq with Fedora and Red Hat Enterprise Linux

CVE-2020-14312

Summary

A flaw exists in the default configuration of dnsmasq, commonly included with Fedora prior to version 31 and all versions of Red Hat Enterprise Linux. The service listens for DNS queries on any interface and is configured to accept requests from addresses outside its local subnet, primarily due to the 'local-service' option being disabled. This misconfiguration can lead to dnsmasq functioning as an open resolver, exposing it to the internet. Consequently, this vulnerability could be exploited by attackers to mount Distributed Denial of Service (DDoS) attacks against other systems.

References