CVE-2015-8899

What it actually does

Dnsmasq crashes when processing a DNS reply containing an empty address for a locally defined A or AAAA record due to improper input validation on the response data.

Why it matters to the business

DNS resolution services become unavailable, disrupting network name lookup for applications and users until the service is restarted.

How an attack unfolds

An attacker controlling a remote DNS server sends a crafted reply with an empty address record that matches a locally configured name; Dnsmasq fails to handle the empty data and terminates.

How to fix it

Upgrade Dnsmasq to version 2.76 or later on all affected systems; apply vendor patches for Ubuntu and other distributions.

How to confirm the fix worked

Confirm Dnsmasq version is 2.76 or newer; test resolution of locally defined names against external queries that return empty address records.

Typical attack path

1. Attacker positions a malicious DNS server in the query path or poisons upstream resolution
2. Victim Dnsmasq instance issues a query for a locally defined name
3. Attacker returns a reply with an empty A or AAAA record
4. Dnsmasq crashes on input validation failure

How to detect it

Review system logs for Dnsmasq segmentation faults or crashes coinciding with DNS query activity; inspect packet captures for DNS responses containing empty A/AAAA records.

What your security team should do

• Prioritize upgrade of all Dnsmasq instances to 2.76+
• Monitor for unexpected Dnsmasq process restarts
• Review upstream DNS server configurations for exposure