FKIE_CVE-2009-2957

Vulnerability from fkie_nvd - Published: 2009-09-02 15:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request.
References
cve@mitre.orghttp://secunia.com/advisories/36563
cve@mitre.orghttp://www.coresecurity.com/content/dnsmasq-vulnerabilitiesPatch
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2009-1238.html
cve@mitre.orghttp://www.securityfocus.com/bid/36121Patch
cve@mitre.orghttp://www.thekelleys.org.uk/dnsmasq/CHANGELOGVendor Advisory
cve@mitre.orghttp://www.ubuntu.com/usn/USN-827-1
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=519020
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10538
cve@mitre.orghttps://rhn.redhat.com/errata/RHSA-2010-0095.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36563
af854a3a-2127-422b-91ae-364da2661108http://www.coresecurity.com/content/dnsmasq-vulnerabilitiesPatch
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2009-1238.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/36121Patch
af854a3a-2127-422b-91ae-364da2661108http://www.thekelleys.org.uk/dnsmasq/CHANGELOGVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-827-1
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=519020
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10538
af854a3a-2127-422b-91ae-364da2661108https://rhn.redhat.com/errata/RHSA-2010-0095.html
Impacted products
Vendor Product Version
thekelleys dnsmasq *
thekelleys dnsmasq 0.4
thekelleys dnsmasq 0.5
thekelleys dnsmasq 0.6
thekelleys dnsmasq 0.7
thekelleys dnsmasq 0.95
thekelleys dnsmasq 0.96
thekelleys dnsmasq 0.98
thekelleys dnsmasq 0.992
thekelleys dnsmasq 0.996
thekelleys dnsmasq 1.0
thekelleys dnsmasq 1.2
thekelleys dnsmasq 1.3
thekelleys dnsmasq 1.4
thekelleys dnsmasq 1.5
thekelleys dnsmasq 1.6
thekelleys dnsmasq 1.7
thekelleys dnsmasq 1.8
thekelleys dnsmasq 1.9
thekelleys dnsmasq 1.10
thekelleys dnsmasq 1.11
thekelleys dnsmasq 1.12
thekelleys dnsmasq 1.13
thekelleys dnsmasq 1.14
thekelleys dnsmasq 1.15
thekelleys dnsmasq 1.16
thekelleys dnsmasq 1.17
thekelleys dnsmasq 1.18
thekelleys dnsmasq 2.0
thekelleys dnsmasq 2.1
thekelleys dnsmasq 2.2
thekelleys dnsmasq 2.3
thekelleys dnsmasq 2.4
thekelleys dnsmasq 2.5
thekelleys dnsmasq 2.6
thekelleys dnsmasq 2.7
thekelleys dnsmasq 2.8
thekelleys dnsmasq 2.9
thekelleys dnsmasq 2.10
thekelleys dnsmasq 2.11
thekelleys dnsmasq 2.12
thekelleys dnsmasq 2.13
thekelleys dnsmasq 2.14
thekelleys dnsmasq 2.15
thekelleys dnsmasq 2.16
thekelleys dnsmasq 2.17
thekelleys dnsmasq 2.18
thekelleys dnsmasq 2.19
thekelleys dnsmasq 2.20
thekelleys dnsmasq 2.21
thekelleys dnsmasq 2.22
thekelleys dnsmasq 2.23
thekelleys dnsmasq 2.24
thekelleys dnsmasq 2.25
thekelleys dnsmasq 2.26
thekelleys dnsmasq 2.27
thekelleys dnsmasq 2.28
thekelleys dnsmasq 2.29
thekelleys dnsmasq 2.30
thekelleys dnsmasq 2.31
thekelleys dnsmasq 2.33
thekelleys dnsmasq 2.34
thekelleys dnsmasq 2.35
thekelleys dnsmasq 2.36
thekelleys dnsmasq 2.37
thekelleys dnsmasq 2.38
thekelleys dnsmasq 2.39
thekelleys dnsmasq 2.40
thekelleys dnsmasq 2.41
thekelleys dnsmasq 2.42
thekelleys dnsmasq 2.43
thekelleys dnsmasq 2.44
thekelleys dnsmasq 2.45
thekelleys dnsmasq 2.46
thekelleys dnsmasq 2.47
thekelleys dnsmasq 2.48
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C214CD9-059C-4211-A20F-A9C32D96EE5D",
              "versionEndIncluding": "2.49",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C940D03A-EAAB-4A9F-BAD9-F5B3A8B626F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "DFF93550-7A3C-4F8F-B242-EBA90F8DA820",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB34D798-1CE9-478E-ABF6-502AEB5153BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "83842D26-CD1A-4880-BFB2-A29C681DEF54",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:0.95:*:*:*:*:*:*:*",
              "matchCriteriaId": "37F2C4F7-183F-43A6-AB7E-D7A11E8FA6F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:0.96:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5BB5AEA-8B22-4F2A-A7B2-B974475C92D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:0.98:*:*:*:*:*:*:*",
              "matchCriteriaId": "94C97061-04B7-42F9-8C82-B405C3AD0614",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:0.992:*:*:*:*:*:*:*",
              "matchCriteriaId": "1936D4A9-A8DF-4DCE-94CA-027C40E86E62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:0.996:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E8954FA-4913-47A1-8FAD-A2D1E9CAF8D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E34FF38A-8B3B-4299-911D-FBB0DC6AC700",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DFBABB9-056D-45EB-87F6-47A25C5A0297",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2263A232-EAA9-49DC-B91F-2F73C45AA68B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "869D7B02-6EA7-4A7D-B6CA-93BD2E057784",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D90FB55-73CB-4F99-92C6-99AD49872CEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CE1A634-20CF-43A0-9441-E249C09D1938",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE397BC5-E523-4048-8B75-A332B618C64D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC86CFA8-7019-481D-B6ED-F4152DA64C85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "48EFFFBE-15EB-4A17-A285-A7299D771391",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CAF4136-4587-4C1D-B303-518820A6E17A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CD4F393-64A2-42AD-8CBA-80F9FBC3307A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "17C26CD9-9357-4275-A46B-D63A5C20EDE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5CC931A-3B4D-4E0C-AB80-DCBB18260079",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E80EE61-3271-4BB6-BCBD-F85492B2B865",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B539B5-ACCD-4BDC-962E-7E9FCE33D263",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "1537C31B-FB1A-40AC-8FFF-033B3CBD236B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "86965249-76A4-4963-AD92-CE244E1EC6F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:1.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE2B2312-A4F9-422E-89EC-687D26500B39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "955C42CA-93C0-41B5-9687-1F8476BA9846",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D463C1BC-35A9-4AD7-8908-BBB293CE2FE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A3F0716-7898-40AC-8E25-B93CA64A04E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6FB1BA4-C1F9-44F4-8048-33CC26AD1C95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6730AA2-C4EE-4FE6-BA20-CBC58EDD16B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "61593637-2CD7-48A1-A31C-E5DE62424B26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "52309F28-53FD-438C-9913-7228B8387DE5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "B252C33B-0144-4737-B34E-761B227F9EF8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2C6DA43-93AC-462B-81E7-6A6819AF8988",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BFBF5E9-7287-4B1D-AD78-0E30A5E2F0E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "58DB4CAB-2ED9-473A-8B36-FA4F941A8281",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "644F05EE-9019-4BD8-9F2C-5DEF2E8FE486",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "07A3613F-A4FC-4643-A155-27A6BAB890C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F74BAF2-F875-4394-9447-9201520E65A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "96141817-BC07-4643-8E57-63445E65F720",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "C391DF4E-9FA3-44FE-AF61-52461EC209C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "F06E581B-2A84-4145-91DC-2B9D4ADC227B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "CAC75365-A06A-4EF2-A54D-2595B480C9DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "34412174-A7A5-4D8A-8D04-BB187594852B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BC0DDCD-5AE5-4F4C-9C17-97803CCB8810",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "14FAD4A7-FB21-4B37-9403-09D2CCF68888",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7A05414-B0DC-4D7B-B542-ACF407822EE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5C8F897-1A9F-4D25-A42B-8F31DD14E2C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "5505D0A5-9D21-4563-81AA-7CAB3D369514",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCC53D53-4652-40D4-8F9A-D704BCEABDA4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "4ADECE43-F034-43E5-AA84-3EB336877DEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "78F10EE3-93C4-4FF5-874D-BEDD9E3F3A93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.27:*:*:*:*:*:*:*",
              "matchCriteriaId": "0603A8CB-3096-4A68-8B9E-4512A9E8D210",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.28:*:*:*:*:*:*:*",
              "matchCriteriaId": "C29425C5-EBDF-4092-8A47-9D0A00122B5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.29:*:*:*:*:*:*:*",
              "matchCriteriaId": "36FDAB2B-740B-4AA8-AF48-DB7FA69E5F9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "DED55642-B6EA-437E-9DA3-23A77C3D2131",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "65412752-9C17-4DAC-A623-FA6AAF36A303",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.33:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB334E27-499F-4C42-BDA7-3E62EE7CE562",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.34:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBE126DF-AF32-4146-82D0-64D7423155DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.35:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B6ACF5F-43D6-442E-9846-CCCF37DB4F5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.36:*:*:*:*:*:*:*",
              "matchCriteriaId": "8995A4B1-C576-443B-BA96-6FC39E63A7BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.37:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E1AF984-B7BA-4F1A-BDA2-DBF66E3FB320",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.38:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F34176B-9712-4F36-8C4F-B2FAD72B4441",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.39:*:*:*:*:*:*:*",
              "matchCriteriaId": "F978EB99-7E43-4E2D-92B5-F09AFBB80949",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "A15AC9BA-102F-401B-A7C7-D2B1AF81F795",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.41:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1DE877B-54A3-4631-ABA8-29BAB4D3DD6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.42:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BE68B29-59F7-443A-A185-A11DE153D969",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.43:*:*:*:*:*:*:*",
              "matchCriteriaId": "00A857D2-A159-4577-AF8B-51742256DC59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.44:*:*:*:*:*:*:*",
              "matchCriteriaId": "09679031-5CDD-46DC-9FD9-7C3459775D55",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.45:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9DE3027-9521-491F-B982-402D191214EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.46:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AF13585-74CE-4B62-BB29-8F7E5FABB66B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.47:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C2ECBD5-AF65-402E-80FE-BAF1144B3C29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:thekelleys:dnsmasq:2.48:*:*:*:*:*:*:*",
              "matchCriteriaId": "558DDC2F-DAF6-42BE-B36A-D998EBADBC95",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en memoria din\u00e1mica en la funci\u00f3n tftp_request en tftp.c en dnsmasq anterior v2.50, cuando --enable-tftp es usado, puede permitir a atacantes remotos ejecutar c\u00f3digo a su elecci\u00f3n a trav\u00e9s de un nombre de fichero largo en un paquete TFTP, como queda demostrado en una lectura de respuesta (RRQ)."
    }
  ],
  "id": "CVE-2009-2957",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-09-02T15:30:01.407",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/36563"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.coresecurity.com/content/dnsmasq-vulnerabilities"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1238.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/36121"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.thekelleys.org.uk/dnsmasq/CHANGELOG"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-827-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=519020"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10538"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/36563"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.coresecurity.com/content/dnsmasq-vulnerabilities"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1238.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/36121"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.thekelleys.org.uk/dnsmasq/CHANGELOG"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-827-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=519020"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10538"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.