Security Advisory 2021-01-19-1 - dnsmasq multiple vulnerabilities

Release and security announcements
144

Thanks for a quick help.
I did realize, indeed, that I should have updated the package list before the upgrade.
Now I did, and successfully upgraded the dnsmasq.
Hopefully my experience helps other people from doing the same trivial mistake.

Thanks.

1 Like
145

Hi, just to verify, I ran the upgrade commands in the first post. I'm on david's build (pretty old but pretty darn good I must say).
Now it says 2.81-2, am I safe and upgraded? Thanks!

# opkg list-installed dnsmasq*
dnsmasq - 2.81-2
146

No, you are using some old OpenWrt version and have an old version of dnsmasq.
Based on 2,81, you likely have an old master build, which tries to upgrade from old mvebu packages. The mvebu package arch was changed a few months ago from arm_cortex-a9_vfpv3 to arm_cortex-a9_vfpv3-d16.

Sysupgrade to a current build.

2 Likes
147

Thanks hnyman, appreciate it a lot.
My david build's quite old and I'm not looking into upgrading it at the moment (it just works so well).
Could I "use" a newer package to upgrade only dnsmasq and not do a full sysupgrade?
I'm looking into other builds but at the moment I'm not sure what to do..

148

You might try, as there is nothing fundamentally different after the mvebu arm_cortex-a9_vfpv3-d16 change except that the processor flags used in compilation are tuned down to accommodate the weakest devices of the Linksys mvebu series. It still uses the same musl libc, so the compiled binaries should be rather ok.

You might try downloading and manually installing with opkg the current package from https://downloads.openwrt.org/snapshots/packages/arm_cortex-a9_vfpv3-d16/base/dnsmasq_2.84-1_arm_cortex-a9_vfpv3-d16.ipk

Just wget it to the router's /tmp and use opkg to install it.

If you brick the device, install a newer build or revert back to the old dnsmasq.

1 Like
149

Hello. I was reading this thread and applying the changes that are suggested here.
I have upgraded my OS 2 days ago and I did what Step 2 says but using vi directly rather than UCI commands, however, I searched in luCI frontend for that DNSSEC option and I couldn't find it. Should I have this option? Where should I find it?

Step 3 says to check the versions we have of dnsmasq. I have the following versions:

root@OpenWrt:~# opkg list-installed dnsmasq*
dnsmasq - 2.80-16.3

Then, one more thing.
It's said to restart dnsmasq. Isn't this done by running /etc/init.d/dns ? Or what is the difference between dnsmasq and dns services?

150

There is no dns service script file on my OpenWRT, just dnsmasq. Do you have one, or is this from a different Linux system you use?

In either case, you need to restart the dnsmasq service, so use "/etc/init.d/dnsmasq". Monitor the logs and you should see if the service goes through a shutdown/start cycle properly.

151

I updated to Openwrt V19.07.6, and im constantly getting this error

Sat Mar  6 12:57:17 2021 daemon.err dnsmasq[8202]: failed to send packet: Network unreachable
Sat Mar  6 12:57:17 2021 daemon.err dnsmasq[8202]: failed to send packet: Network unreachable
Sat Mar  6 12:57:17 2021 daemon.err dnsmasq[8202]: failed to send packet: Network unreachable
Sat Mar  6 12:57:17 2021 daemon.err dnsmasq[8202]: failed to send packet: Network unreachable
Sat Mar  6 12:57:17 2021 daemon.err dnsmasq[8202]: failed to send packet: Network unreachable

Anyone know how to fix this?

152

Update to 19.07.7

1 Like
153

Thank you! Quick question, can I update OpenWRT over my wifi network or is it best suggested to update over ethernet?

154

Yes, you can do it over wifi; but yes, it is advised to do it over ethernet.

1 Like
155

Thanks, just got it updated and the errors went away

1 Like