6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.269 Low
EPSS
Percentile
96.7%
CentOS Errata and Security Advisory CESA-2009:1238
Dnsmasq is a lightweight and easy to configure DNS forwarder and DHCP
server.
Core Security Technologies discovered a heap overflow flaw in dnsmasq when
the TFTP service is enabled (the ββenable-tftpβ command line option, or by
enabling βenable-tftpβ in β/etc/dnsmasq.confβ). If the configured tftp-root
is sufficiently long, and a remote user sends a request that sends a long
file name, dnsmasq could crash or, possibly, execute arbitrary code with
the privileges of the dnsmasq service (usually the unprivileged βnobodyβ
user). (CVE-2009-2957)
A NULL pointer dereference flaw was discovered in dnsmasq when the TFTP
service is enabled. This flaw could allow a malicious TFTP client to crash
the dnsmasq service. (CVE-2009-2958)
Note: The default tftp-root is β/var/ftpdβ, which is short enough to make
it difficult to exploit the CVE-2009-2957 issue; if a longer directory name
is used, arbitrary code execution may be possible. As well, the dnsmasq
package distributed by Red Hat does not have TFTP support enabled by
default.
All users of dnsmasq should upgrade to this updated package, which contains
a backported patch to correct these issues. After installing the updated
package, the dnsmasq service must be restarted for the update to take
effect.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2009-September/078281.html
https://lists.centos.org/pipermail/centos-announce/2009-September/078282.html
Affected packages:
dnsmasq
Upstream details at:
https://access.redhat.com/errata/RHSA-2009:1238
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 5 | i386 | dnsmasq | <Β 2.45-1.1.el5_3 | dnsmasq-2.45-1.1.el5_3.i386.rpm |
CentOS | 5 | i386 | dnsmasq | <Β 2.45-1.1.el5_3 | dnsmasq-2.45-1.1.el5_3.i386.rpm |
CentOS | 5 | x86_64 | dnsmasq | <Β 2.45-1.1.el5_3 | dnsmasq-2.45-1.1.el5_3.x86_64.rpm |
CentOS | 5 | x86_64 | dnsmasq | <Β 2.45-1.1.el5_3 | dnsmasq-2.45-1.1.el5_3.x86_64.rpm |