ID

VAR-200909-0342

CVE

CVE-2009-2958

TITLE

dnsmasq of tftp_request Service disruption in functions (DoS) Vulnerabilities

DESCRIPTION

The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option. dnsmasq of tftp_request Functions include --enable-tftp If you use blksize Service operation disruption due to incomplete processing of requests with options (DoS) There is a vulnerability that becomes a condition.Service operation disruption to a third party (DoS) There is a possibility of being put into a state. Dnsmasq is prone to a NULL-pointer dereference vulnerability. An attacker can exploit this issue to crash the affected application, denying service to legitimate users. NOTE: The TFTP service must be enabled for this issue to be exploitable; this is not the default. Versions *prior to* Dnsmasq 2.50 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1876-1 security@debian.org http://www.debian.org/security/ Florian Weimer September 01, 2009 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : dnsmasq Vulnerability : buffer overflow Problem type : remote Debian-specific: no CVE Id(s) : CVE-2009-2957 CVE-2009-2958 Several remote vulnerabilities have been discovered in the TFTP component of dnsmasq. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2957 A buffer overflow in TFTP processing may enable arbitrary code execution to attackers which are permitted to use the TFTP service. CVE-2009-2958 Malicious TFTP clients may crash dnsmasq, leading to denial of service. The old stable distribution is not affected by these problems. For the stable distribution (lenny), these problems have been fixed in version 2.45-1+lenny1. For the unstable distribution (sid), these problems have been fixed in version 2.50-1. We recommend that you upgrade your dnsmasq packages. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 5.0 alias lenny - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45.orig.tar.gz Size/MD5 checksum: 377466 59106495260bb2d0f184f0d4ae88d740 http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1.diff.gz Size/MD5 checksum: 14514 c841708d86ea6a13f4f168d311638ff5 http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1.dsc Size/MD5 checksum: 1006 377658fb3cb46cc670a86e475ff70533 Architecture independent packages: http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1_all.deb Size/MD5 checksum: 12110 716c6f4f6e478f5a0f248725e4544dda alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_alpha.deb Size/MD5 checksum: 267294 d7ba6bd2b7363246587cf4ab8b78f721 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_amd64.deb Size/MD5 checksum: 258118 3b5fc290f6bfacd7450fbc138e63bcb7 arm architecture (ARM) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_arm.deb Size/MD5 checksum: 250676 0011c21826ab5f3b9c64444113acc97f armel architecture (ARM EABI) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_armel.deb Size/MD5 checksum: 252830 5999eff243a849fe31fba765e92228d0 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_hppa.deb Size/MD5 checksum: 258292 cadea4880ef01292affd271cde276226 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_i386.deb Size/MD5 checksum: 251182 cdad8cd873dc28fd69fdd7ca2e59cec1 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_ia64.deb Size/MD5 checksum: 301522 2723ddacd61bf4378115a1701848fa2c mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_mips.deb Size/MD5 checksum: 256426 0873691aa0b37c2873e93e1132d0db95 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_mipsel.deb Size/MD5 checksum: 257982 dd6342a053fc0bb9a3be6ec5b4aa3b2f powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_powerpc.deb Size/MD5 checksum: 257426 58e705f584e41b2598a6d62bfc7e2671 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_s390.deb Size/MD5 checksum: 255328 3abfb764f944344064aed16352156b04 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_sparc.deb Size/MD5 checksum: 252234 4a6db5969b47698346b59828928dc0b5 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iQEcBAEBAgAGBQJKnXmhAAoJEL97/wQC1SS+BPQIAK1x7nctuD1BkdIVjSt5BXRG cBlfdwgsyjXLoLocyN6A1lsHwcAcFPZI189aqLD2MU8MBJmugDdgReF4d6GTLI/T zv2G0fkj9rggJXAeqpFOlMK/nhUNxRDAn8h/ZgXcFuTkY0zm1M2D1qhqKpvOjByC U7im5+V/rp9VAFOaTdMnnvnBJX2nRnXULj85eIAaJYZSahX544UfKi6GLkjN0wji b/FJvtn9yOT6Rkzgs528icZ3ZoDslTV8xQhuBgILhCcP5Dmp7JokbdzZ7h3zH1YV 8b0WwxEIF/mhmhlNVYDP6n2k2jLw+zLBF2c5jSIlHa67vChsLGeU3auqXAHMpq0= =h2eE -----END PGP SIGNATURE----- . =========================================================== Ubuntu Security Notice USN-827-1 September 01, 2009 dnsmasq vulnerabilities CVE-2009-2957, CVE-2009-2958 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 8.04 LTS Ubuntu 8.10 Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.04 LTS: dnsmasq-base 2.41-2ubuntu2.2 Ubuntu 8.10: dnsmasq-base 2.45-1ubuntu1.1 Ubuntu 9.04: dnsmasq-base 2.47-3ubuntu0.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: IvAin Arce, Pablo HernAin Jorge, Alejandro Pablo Rodriguez, MartA\xadn Coco, Alberto SoliAto Testa and Pablo Annetta discovered that Dnsmasq did not properly validate its input when processing TFTP requests for files with long names. Dnsmasq runs as the 'dnsmasq' user by default on Ubuntu. (CVE-2009-2957) Steve Grubb discovered that Dnsmasq could be made to dereference a NULL pointer when processing certain TFTP requests. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Ubuntu update for dnsmasq SECUNIA ADVISORY ID: SA36563 VERIFY ADVISORY: http://secunia.com/advisories/36563/ DESCRIPTION: Ubuntu has issued an update for dnsmasq. This fixes two vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system. For more information: SA36394 SOLUTION: Apply updated packages. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200909-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Dnsmasq: Multiple vulnerabilities Date: September 20, 2009 Bugs: #282653 ID: 200909-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities in Dnsmasq might result in the remote execution of arbitrary code, or a Denial of Service. Background ========== Dnsmasq is a lightweight, easy to configure DNS forwarder and DHCP server. It includes support for Trivial FTP (TFTP). Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-dns/dnsmasq < 2.5.0 >= 2.5.0 Description =========== Multiple vulnerabilities have been reported in the TFTP functionality included in Dnsmasq: * Pablo Jorge and Alberto Solino discovered a heap-based buffer overflow (CVE-2009-2957). * An anonymous researcher reported a NULL pointer reference (CVE-2009-2958). Impact ====== A remote attacker in the local network could exploit these vulnerabilities by sending specially crafted TFTP requests to a machine running Dnsmasq, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the daemon, or a Denial of Service. Workaround ========== You can disable the TFTP server either at buildtime by not enabling the "tftp" USE flag, or at runtime. Make sure "--enable-tftp" is not set in the DNSMASQ_OPTS variable in the /etc/conf.d/dnsmasq file and "enable-tftp" is not set in /etc/dnsmasq.conf, either of which would enable TFTP support if it is compiled in. Resolution ========== All Dnsmasq users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =net-dns/dnsmasq-2.5.0 References ========== [ 1 ] CVE-2009-2957 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2957 [ 2 ] CVE-2009-2958 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2958 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200909-19.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Simon Kelley

SOURCES

LAST UPDATE DATE

2024-11-23T22:09:21.184000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE