DEBIAN-CVE-2009-2958

The tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a TFTP read aka RRQ request with a malformed blksize option...

CVE-2009-2958

The tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a TFTP read aka RRQ request with a malformed blksize option...

CVE-2009-2957

Heap-based buffer overflow in the tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read aka RRQ request...

CVE-2009-2957

Heap-based buffer overflow in the tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read aka RRQ request...

Null pointer dereference

The tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a TFTP read aka RRQ request with a malformed blksize option...

CVE-2009-2958

The tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a TFTP read aka RRQ request with a malformed blksize option...

CVE-2009-2957

Dnsmasq (dnsmasq) contains a heap-based buffer overflow in the TFTP handling path (tftp_request) when the --enable-tftp option is used, allowing remote attackers to potentially execute arbitrary code or crash the service by sending a crafted TFTP RRQ with a long filename. A related NULL-pointer d...

CVE-2009-2958

CVE-2009-2958 affects the dnsmasq TFTP implementation. The vulnerability exists in tftp_request() in dnsmasq before 2.50 when --enable-tftp is used, allowing remote attackers to crash the daemon via a crafted TFTP read request that triggers a NULL pointer dereference (DoS). The related issue CVE-...

CVE-2009-2957

Heap-based buffer overflow in the tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read aka RRQ request...

CVE-2009-2958

The tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a TFTP read aka RRQ request with a malformed blksize option...

CVE-2009-2958

The tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a TFTP read aka RRQ request with a malformed blksize option...

CVE-2009-2957

Heap-based buffer overflow in the tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read aka RRQ request...

[SECURITY] [DSA 1876-1] New dnsmasq packages fix remote code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1876-1 [email protected] http://www.debian.org/security/ Florian Weimer September 01, 2009 http://www.debian.org/security/faq -...

RedHat Security Advisory RHSA-2009:1238

The remote host is missing updates announced in advisory RHSA-2009:1238. Dnsmasq is a lightweight and easy to configure DNS forwarder and DHCP server. Core Security Technologies discovered a heap overflow flaw in dnsmasq when the TFTP service is enabled the --enable-tftp command line option, or b...

SolarWinds TFTP Server OACK请求拒绝服务漏洞

BUGTRAQ ID: 36182 SolarWinds TFTP服务程序可以同时发送和接收多个文件，常用于下载/上传路由器、交换机等可执行映象和配置文件。 远程攻击者可以通过向SolarWinds TFTP服务器发送特制的选项确认（OACK）请求报文导致服务器终止。 SolarWinds TFTP Server = 9.2.0.111 厂商补丁： SolarWinds ---------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://solarwinds.net !/usr/bin/perl SolarWinds TFT...

Core Security Technologies Advisory 2009.0820

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server 1. Advisory Information Title: Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server...

Dnsmasq TFTP服务远程空指针引用漏洞

BUGTRAQ ID: 36120 CVECAN ID: CVE-2009-2958 Dnsmasq是可方便配置的轻型DNS转发器和DHCP服务器。 dnsmasq在启用了TFTP服务的时候存在空指针引用漏洞，可能允许恶意的TFTP服务端导致dnsmasq服务崩溃。 漏洞的起因是以下循环中的第一个if： /----------- while opt = next&p, end if strcasecmpopt, "blksize" == 0 && opt = next&p, end && !daemon-options & OPTTFTPNOBLOCK transfer-blocksiz...

dnsmasq multiple security vulnerabilities

Multiple vulnerabilities on TFTP processing...

Dnsmasq TFTP服务远程堆溢出漏洞

BUGTRAQ ID: 36121 CVECAN ID: CVE-2009-2957 Dnsmasq是可方便配置的轻型DNS转发器和DHCP服务器。 dnsmasq在启用了TFTP服务（--enable-tftp命令行选项或在/etc/dnsmasq.conf中启用enable-tftp）的时候存在堆溢出漏洞。如果所配置的tftp-root足够长，且远程用户发送的请求中包含有超长的文件名，dnsmasq就可能崩溃或以dnsmasq服务的权限（通常为非特权的nobody用户）执行任意代码。...

Dnsmasq TFTP Service 2.40 - 2.49 Multiple Vulnerabilities

Dnsmasq is prone to a remotely exploitable heap-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it into an insufficiently sized memory buffer. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a...