Bug 519020 (CVE-2009-2957, CVE-2009-2958) - CVE-2009-2957, CVE-2009-2958 dnsmasq: multiple vulnerabilities in TFTP server
Summary: CVE-2009-2957, CVE-2009-2958 dnsmasq: multiple vulnerabilities in TFTP server
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-2957, CVE-2009-2958
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,source=secalert,repo...
Depends On: 519021 519022 520512 833889
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-08-24 16:09 UTC by Vincent Danen
Modified: 2019-06-08 12:48 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-03-29 10:11:17 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1238 normal SHIPPED_LIVE Important: dnsmasq security update 2009-09-01 00:18:44 UTC

Description Vincent Danen 2009-08-24 16:09:49 UTC
Core Security Technologies discovered a heap overflow vulnerability in dnsmasq when the TFTP service is enabled ('--enable-tftp').  If the configured tftp-prefix is sufficiently long, and a remote user sent a request which sends a long file name, dnsmasq could crash or, possibly, execute arbitrary code with root privileges.

The default tftp-prefix is /var/tftpd, which is short enough to make this difficult to exploit; if a longer prefix is used then arbitrary code execution may be possible.  As well, Red Hat does not have TFTP support enabled by default.

Comment 7 Vincent Danen 2009-08-24 22:26:44 UTC
CORE has provided two CVE names:

CVE-2009-2957 for the heap overflow issue they found (possibly arbitrary code execution).

CVE-2009-2958 for the NULL-pointer dereference Steve found (remote DoS).

The disclosure date is August 31st.

Comment 9 Vincent Danen 2009-08-25 14:22:49 UTC
This is not a critical issue.  dnsmasq starts up as root but by default drops privileges to run as user nobody.  Because it runs non-privileged, and because of the non-default configuration requirements (i.e. enabling TFTP requires running dnsmasq without the initscript or modifying the initscript to enable it), as well as the fact that dnsmasq should realistically only ever be available to the local area network and not the internet-at-large, makes this an important impact issue.

Comment 10 Vincent Danen 2009-08-31 20:53:37 UTC
Embargo is lifted; 2.50 is available:

http://www.thekelleys.org.uk/dnsmasq/

Comment 12 errata-xmlrpc 2009-09-01 00:18:47 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1238 https://rhn.redhat.com/errata/RHSA-2009-1238.html

Comment 13 Tomas Hoger 2009-09-02 07:42:58 UTC
Core Security advisory:
  http://www.coresecurity.com/content/dnsmasq-vulnerabilities

Comment 14 Fedora Update System 2009-10-14 01:33:47 UTC
dnsmasq-2.46-3.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2009-10-14 01:58:52 UTC
dnsmasq-2.46-2.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.