<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">Buffer overflows are in the news again as I am sure people have heard by now.</div><div class=""><br class=""></div><div class="">The post on the google security blog about it seems to indicate that dnsmasq may be used to mitigate the problem, at least until patching could be done.</div><div class=""><br class=""></div><div class="">See: <a href="https://googleonlinesecurity.blogspot.ca/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html" class="">https://googleonlinesecurity.blogspot.ca/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html</a></div><div class=""><br class=""></div><div class="">I have some production servers running both dnsmasq (2.48) and the affected glibc.</div><div class=""><br class=""></div><div class="">Do I understand correctly that running dnsmasq in its default configuration should limit dns replies handled to 1280 bytes?</div><div class="">I see this in the manpage: </div><div class=""><br class=""></div><div class=""> -P, --edns-packet-max=<size><br class=""> Specify the largest EDNS.0 UDP packet which is supported by the DNS forwarder. Defaults to 1280, which is<br class=""> the RFC2671-recommended maximum for ethernet.</div><div class=""><br class=""></div><div class="">Since the vulnerability relies on a reply of at least 2048 bytes, can I assume I am fine until I can update these systems and reboot them (which should be soon, but just not yet…)? </div><div class="">Does that setting also apply to TCP replies?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Best regards,</div><div class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " class="">--</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " class="">Louis Munro<br class=""><a href="mailto:lmunro@inverse.ca" class="">lmunro@inverse.ca</a> :: <a href="http://www.inverse.ca" class="">www.inverse.ca</a> <br class="">+1.514.447.4918 x125 :: +1 (866) 353-6153 x125<br class="">Inverse inc. :: Leaders behind SOGo (<a href="http://www.sogo.nu" class="">www.sogo.nu</a>) and PacketFence (<a href="http://www.packetfence.org" class="">www.packetfence.org</a>)</div></div>
</div>
<br class=""></div></body></html>