{"id":170683,"date":"2026-05-15T00:24:28","date_gmt":"2026-05-14T22:24:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-dnsmasq-dopuskayushhie-otravlenie-dns-kesha-i-vypolnenie-koda-s-pravami-root"},"modified":"2026-05-15T00:24:28","modified_gmt":"2026-05-14T22:24:28","slug":"uyazvimosti-v-dnsmasq-dopuskayushhie-otravlenie-dns-kesha-i-vypolnenie-koda-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-dnsmasq-dopuskayushhie-otravlenie-dns-kesha-i-vypolnenie-koda-s-pravami-root","title":{"rendered":"Zranitelnosti v dnsmasq, kter\u00e9 umo\u017e\u0148uj\u00ed otravu DNS cache a prov\u00e1d\u011bn\u00ed k\u00f3du s pr\u00e1vy root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V bal\u00ed\u010dku Dnsmasq, kter\u00fd spojuje cache DNS resolver, DHCP server, slu\u017ebu pro inzerci IPv6 cest a syst\u00e9m pro s\u00ed\u0165ov\u00e9 bootov\u00e1n\u00ed, bylo zji\u0161t\u011bno 6 zranitelnost\u00ed, kter\u00e9 umo\u017e\u0148uj\u00ed prov\u00e1d\u011bn\u00ed k\u00f3du s pr\u00e1vy root, p\u0159esm\u011brov\u00e1n\u00ed dom\u00e9ny na jinou IP, \u010dten\u00ed obsahu pam\u011bti procesu a vyvol\u00e1n\u00ed hav\u00e1rie slu\u017eby. Probl\u00e9my byly odstran\u011bny ve vyd\u00e1n\u00ed dnsmasq 2.92rel2. Opravy jsou tak\u00e9 k dispozici ve form\u011b patch\u016f.             <\/p>\n<p>Identifikovan\u00e9 probl\u00e9my:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2026-4892 \u2014 p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku v implementaci DHCPv6, kter\u00e9 \u00fato\u010dn\u00edkovi s p\u0159\u00edstupem k m\u00edstn\u00ed s\u00edti umo\u017e\u0148uje spustit k\u00f3d s pr\u00e1vy root prost\u0159ednictv\u00edm odesl\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00e9ho paketu DHCPv6. P\u0159ete\u010den\u00ed je zp\u016fsobeno t\u00edm, \u017ee p\u0159i z\u00e1pisu DHCPv6 CLID do z\u00e1sobn\u00edku nebylo br\u00e1no v \u00favahu, \u017ee v paketu jsou data uchov\u00e1v\u00e1na v \u0161estn\u00e1ctkov\u00e9 podob\u011b, p\u0159i\u010dem\u017e se pou\u017e\u00edvaj\u00ed t\u0159i bajty \u201e%xx\u201c na ka\u017ed\u00fd skute\u010dn\u00fd bajt CLID (nap\u0159\u00edklad ulo\u017een\u00ed 1000-bajtov\u00e9ho CLID povede k z\u00e1pisu 3000 bajt\u016f).\n<li class=\"l\"> CVE-2026-2291 \u2014 p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku ve funkci extract_name(), kter\u00e9 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi vkl\u00e1dat fiktivn\u00ed z\u00e1znamy do DNS cache a dos\u00e1hnout p\u0159esm\u011brov\u00e1n\u00ed. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/domain\/\" title=\"dom\u00e9ny\" data-wpil-keyword-link=\"linked\">dom\u00e9ny<\/a> na jinou IP adresu. P\u0159ete\u010den\u00ed nastalo kv\u016fli alokaci bufferu bez zohledn\u011bn\u00ed escapov\u00e1n\u00ed n\u011bkter\u00fdch znak\u016f ve vnit\u0159n\u00edm zobrazov\u00e1n\u00ed dom\u00e9nov\u00e9ho jm\u00e9na v dnsmasq.\n<li class=\"l\"> CVE-2026-4893 \u2014 \u00fanik informac\u00ed, kter\u00fd umo\u017e\u0148uje obch\u00e1zet kontrolu prost\u0159ednictv\u00edm odes\u00edl\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00e9ho DNS paketu s informacemi o pods\u00edti klienta (RFC 7871). Zranitelnost m\u016f\u017ee b\u00fdt vyu\u017eita ke zm\u011bn\u011b sm\u011brov\u00e1n\u00ed DNS odpov\u011bdi a p\u0159esm\u011brov\u00e1n\u00ed u\u017eivatel\u016f na dom\u00e9nu \u00fato\u010dn\u00edka. Zranitelnost je zp\u016fsobena t\u00edm, \u017ee do funkce check_source() byla p\u0159ed\u00e1na d\u00e9lka z\u00e1znamu OPT nam\u00edsto d\u00e9lky paketu, co\u017e vedlo k tomu, \u017ee funkce v\u017edy vracela \u00fasp\u011b\u0161n\u00fd v\u00fdsledek kontroly.\n<li class=\"l\"> CVE-2026-4891 \u2014 \u010dten\u00ed z oblasti za hranice z\u00e1sobn\u00edku p\u0159i validaci DNSSEC, co\u017e vede k \u00faniku dat z pam\u011bti procesu do odpov\u011bdi p\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00e9ho DNS dotazu.\n<li class=\"l\"> CVE-2026-4890 \u2014 cyklen\u00ed p\u0159i validaci DNSSEC, kter\u00e9 umo\u017e\u0148uje zp\u016fsobit odm\u00edtnut\u00ed slu\u017eby prost\u0159ednictv\u00edm odesl\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00e9ho DNS paketu.\n<li class=\"l\"> CVE-2026-5172 \u2014 \u010dten\u00ed z oblasti za z\u00e1sobn\u00edkem ve funkci extract_addresses(), co\u017e vede k hav\u00e1rii p\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00fdch DNS odpov\u011bd\u00ed.  <\/ul>\n<p>Status of vulnerability remediation in distributions can be assessed on the following pages (if the page is unavailable, it means the developers of the distribution have not yet started addressing the issue): Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, Fedora, OpenWRT, FreeBSD. The Dnsmasq project is involved in the Android platform and specialized distributions such as OpenWrt and DD-WRT, as well as in firmware for wireless routers from many manufacturers. In standard distributions, Dnsmasq can be installed when using libvirt to provide DNS service functionality in <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/vps\/abuzoustojchivye-vps\/\" title=\"virtual machines\" data-wpil-keyword-link=\"linked\">virtual machines<\/a> or activated in the NetworkManager configurator.<br \/>\n<br \/>Zdroj: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65431\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Dnsmasq, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0435\u043c \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0438\u0439 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440, \u0441\u0435\u0440\u0432\u0435\u0440 DHCP, \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043b\u044f \u0430\u043d\u043e\u043d\u0441\u043e\u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 IPv6 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0434\u043e\u043c\u0435\u043d \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 IP, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 dnsmasq 2.92rel2. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0435\u0439. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b: [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170683","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Dnsmasq, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0435\u043c \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0438\u0439 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440, \u0441\u0435\u0440\u0432\u0435\u0440 DHCP, \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043b\u044f \u0430\u043d\u043e\u043d\u0441\u043e\u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 IPv6 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0434\u043e\u043c\u0435\u043d.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-dnsmasq-dopuskayushhie-otravlenie-dns-kesha-i-vypolnenie-koda-s-pravami-root\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 dnsmasq, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u043a\u044d\u0448\u0430 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Dnsmasq, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0435\u043c \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0438\u0439 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440, \u0441\u0435\u0440\u0432\u0435\u0440 DHCP, \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043b\u044f \u0430\u043d\u043e\u043d\u0441\u043e\u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 IPv6 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0434\u043e\u043c\u0435\u043d.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-dnsmasq-dopuskayushhie-otravlenie-dns-kesha-i-vypolnenie-koda-s-pravami-root\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-14T22:24:28+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-14T22:24:28+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilities in dnsmasq allowing DNS cache poisoning and code execution with root privileges | ProHoster","description":"In the Dnsmasq package, which combines a caching DNS resolver, DHCP server, IPv6 route announcement service, and network boot system, 6 vulnerabilities have been identified that allow code execution with root privileges and domain redirection.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-dnsmasq-dopuskayushhie-otravlenie-dns-kesha-i-vypolnenie-koda-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 dnsmasq, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u043a\u044d\u0448\u0430 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Dnsmasq, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0435\u043c \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0438\u0439 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440, \u0441\u0435\u0440\u0432\u0435\u0440 DHCP, \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043b\u044f \u0430\u043d\u043e\u043d\u0441\u043e\u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 IPv6 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0434\u043e\u043c\u0435\u043d.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-dnsmasq-dopuskayushhie-otravlenie-dns-kesha-i-vypolnenie-koda-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-14T22:24:28+00:00","article:modified_time":"2026-05-14T22:24:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/170683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=170683"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/170683\/revisions"}],"predecessor-version":[{"id":170707,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/170683\/revisions\/170707"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=170683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=170683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=170683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}