var-200909-0349
Vulnerability from variot
Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request. Dnsmasq is prone to a remotely exploitable heap-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it into an insufficiently sized memory buffer. Remote attackers can exploit this issue to execute arbitrary machine code in the context of the vulnerable software on the targeted user's computer. Versions prior to Dnsmasq 2.50 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Debian Security Advisory DSA-1876-1 security@debian.org http://www.debian.org/security/ Florian Weimer September 01, 2009 http://www.debian.org/security/faq
Package : dnsmasq Vulnerability : buffer overflow Problem type : remote Debian-specific: no CVE Id(s) : CVE-2009-2957 CVE-2009-2958
Several remote vulnerabilities have been discovered in the TFTP component of dnsmasq.
CVE-2009-2958 Malicious TFTP clients may crash dnsmasq, leading to denial of service.
The old stable distribution is not affected by these problems.
For the stable distribution (lenny), these problems have been fixed in version 2.45-1+lenny1.
For the unstable distribution (sid), these problems have been fixed in version 2.50-1.
We recommend that you upgrade your dnsmasq packages.
Upgrade instructions
wget url will fetch the file for you dpkg -i file.deb will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given below:
apt-get update will update the internal database apt-get upgrade will install corrected packages
You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 5.0 alias lenny
Source archives:
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45.orig.tar.gz Size/MD5 checksum: 377466 59106495260bb2d0f184f0d4ae88d740 http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1.diff.gz Size/MD5 checksum: 14514 c841708d86ea6a13f4f168d311638ff5 http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1.dsc Size/MD5 checksum: 1006 377658fb3cb46cc670a86e475ff70533
Architecture independent packages:
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1_all.deb Size/MD5 checksum: 12110 716c6f4f6e478f5a0f248725e4544dda
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_alpha.deb Size/MD5 checksum: 267294 d7ba6bd2b7363246587cf4ab8b78f721
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_amd64.deb Size/MD5 checksum: 258118 3b5fc290f6bfacd7450fbc138e63bcb7
arm architecture (ARM)
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_arm.deb Size/MD5 checksum: 250676 0011c21826ab5f3b9c64444113acc97f
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_armel.deb Size/MD5 checksum: 252830 5999eff243a849fe31fba765e92228d0
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_hppa.deb Size/MD5 checksum: 258292 cadea4880ef01292affd271cde276226
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_i386.deb Size/MD5 checksum: 251182 cdad8cd873dc28fd69fdd7ca2e59cec1
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_ia64.deb Size/MD5 checksum: 301522 2723ddacd61bf4378115a1701848fa2c
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_mips.deb Size/MD5 checksum: 256426 0873691aa0b37c2873e93e1132d0db95
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_mipsel.deb Size/MD5 checksum: 257982 dd6342a053fc0bb9a3be6ec5b4aa3b2f
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_powerpc.deb Size/MD5 checksum: 257426 58e705f584e41b2598a6d62bfc7e2671
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_s390.deb Size/MD5 checksum: 255328 3abfb764f944344064aed16352156b04
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_sparc.deb Size/MD5 checksum: 252234 4a6db5969b47698346b59828928dc0b5
These files will probably be moved into the stable distribution on its next update.
For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)
iQEcBAEBAgAGBQJKnXmhAAoJEL97/wQC1SS+BPQIAK1x7nctuD1BkdIVjSt5BXRG cBlfdwgsyjXLoLocyN6A1lsHwcAcFPZI189aqLD2MU8MBJmugDdgReF4d6GTLI/T zv2G0fkj9rggJXAeqpFOlMK/nhUNxRDAn8h/ZgXcFuTkY0zm1M2D1qhqKpvOjByC U7im5+V/rp9VAFOaTdMnnvnBJX2nRnXULj85eIAaJYZSahX544UfKi6GLkjN0wji b/FJvtn9yOT6Rkzgs528icZ3ZoDslTV8xQhuBgILhCcP5Dmp7JokbdzZ7h3zH1YV 8b0WwxEIF/mhmhlNVYDP6n2k2jLw+zLBF2c5jSIlHa67vChsLGeU3auqXAHMpq0= =h2eE -----END PGP SIGNATURE----- . =========================================================== Ubuntu Security Notice USN-827-1 September 01, 2009 dnsmasq vulnerabilities CVE-2009-2957, CVE-2009-2958 ===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS Ubuntu 8.10 Ubuntu 9.04
This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 8.04 LTS: dnsmasq-base 2.41-2ubuntu2.2
Ubuntu 8.10: dnsmasq-base 2.45-1ubuntu1.1
Ubuntu 9.04: dnsmasq-base 2.47-3ubuntu0.1
In general, a standard system upgrade is sufficient to effect the necessary changes.
Details follow:
IvAin Arce, Pablo HernAin Jorge, Alejandro Pablo Rodriguez, MartA\xadn Coco, Alberto SoliAto Testa and Pablo Annetta discovered that Dnsmasq did not properly validate its input when processing TFTP requests for files with long names. Dnsmasq runs as the 'dnsmasq' user by default on Ubuntu. (CVE-2009-2957)
Steve Grubb discovered that Dnsmasq could be made to dereference a NULL pointer when processing certain TFTP requests. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability intelligence source on the market.
Implement it through Secunia.
For more information visit: http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com
TITLE: Ubuntu update for dnsmasq
SECUNIA ADVISORY ID: SA36563
VERIFY ADVISORY: http://secunia.com/advisories/36563/
DESCRIPTION: Ubuntu has issued an update for dnsmasq. This fixes two vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.
For more information: SA36394
SOLUTION: Apply updated packages.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200909-19
http://security.gentoo.org/
Severity: Normal Title: Dnsmasq: Multiple vulnerabilities Date: September 20, 2009 Bugs: #282653 ID: 200909-19
Synopsis
Multiple vulnerabilities in Dnsmasq might result in the remote execution of arbitrary code, or a Denial of Service.
Background
Dnsmasq is a lightweight, easy to configure DNS forwarder and DHCP server. It includes support for Trivial FTP (TFTP).
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-dns/dnsmasq < 2.5.0 >= 2.5.0
Description
Multiple vulnerabilities have been reported in the TFTP functionality included in Dnsmasq:
-
Pablo Jorge and Alberto Solino discovered a heap-based buffer overflow (CVE-2009-2957).
-
An anonymous researcher reported a NULL pointer reference (CVE-2009-2958).
Impact
A remote attacker in the local network could exploit these vulnerabilities by sending specially crafted TFTP requests to a machine running Dnsmasq, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the daemon, or a Denial of Service. NOTE: The TFTP server is not enabled by default.
Workaround
You can disable the TFTP server either at buildtime by not enabling the "tftp" USE flag, or at runtime. Make sure "--enable-tftp" is not set in the DNSMASQ_OPTS variable in the /etc/conf.d/dnsmasq file and "enable-tftp" is not set in /etc/dnsmasq.conf, either of which would enable TFTP support if it is compiled in.
Resolution
All Dnsmasq users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose =net-dns/dnsmasq-2.5.0
References
[ 1 ] CVE-2009-2957 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2957 [ 2 ] CVE-2009-2958 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2958
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200909-19.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200909-0349",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.6,
"vendor": "thekelleys",
"version": "1.7"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.6,
"vendor": "thekelleys",
"version": "0.5"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.6,
"vendor": "thekelleys",
"version": "1.2"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.6,
"vendor": "thekelleys",
"version": "1.8"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.6,
"vendor": "thekelleys",
"version": "0.4"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.6,
"vendor": "thekelleys",
"version": "1.5"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.6,
"vendor": "thekelleys",
"version": "1.4"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.6,
"vendor": "thekelleys",
"version": "1.3"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.6,
"vendor": "thekelleys",
"version": "1.6"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.9"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.10"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.4"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.17"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.40"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.0"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.14"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.11"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.29"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.5"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.26"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.27"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.46"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.16"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "0.996"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.35"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.8"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.13"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.25"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.34"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.11"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.3"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.12"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.28"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "0.96"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "0.992"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.38"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.36"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.6"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "0.7"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.24"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.45"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.48"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.9"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.16"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.20"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.21"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.10"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.13"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "0.95"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.0"
},
{
"model": "dnsmasq",
"scope": "lte",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.49"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.2"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.14"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.39"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.30"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.31"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.44"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.7"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.17"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.15"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.18"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.43"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.19"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.47"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.23"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.41"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.22"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.1"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.37"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.33"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.18"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "0.98"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.15"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "1.12"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "0.6"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 1.0,
"vendor": "thekelleys",
"version": "2.42"
},
{
"model": "dnsmasq",
"scope": "lt",
"trust": 0.8,
"vendor": "thekelleys",
"version": "2.50"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "3 (x86)"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "3 (x86-64)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5 (server)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5.0 (client)"
},
{
"model": "enterprise linux eus",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5.3.z (server)"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.6,
"vendor": "thekelleys",
"version": "2.49"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "linux lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "9.04"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "linux lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.10"
},
{
"model": "linux lts sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux lts powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux lts lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.1"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.0"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "10.3"
},
{
"model": "hat fedora",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "11"
},
{
"model": "hat fedora",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "10"
},
{
"model": "hat enterprise linux desktop client",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "5"
},
{
"model": "hat enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "5"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "pardus",
"version": "20090"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.49"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.48"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.47"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.46"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.45"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.44"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.43"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.42"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.41"
},
{
"model": "dnsmasq",
"scope": "eq",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.40"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux mipsel",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux m68k",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux hppa",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux armel",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "dnsmasq",
"scope": "ne",
"trust": 0.3,
"vendor": "dnsmasq",
"version": "2.50"
}
],
"sources": [
{
"db": "BID",
"id": "36121"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-002070"
},
{
"db": "NVD",
"id": "CVE-2009-2957"
},
{
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.48:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.47:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:0.992:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:0.98:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.49",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.44:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.43:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.39:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.38:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.46:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.45:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.25:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.40:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:0.96:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:0.95:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.42:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.41:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.36:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:0.996:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-2957"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Simon Kelley",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
],
"trust": 0.6
},
"cve": "CVE-2009-2957",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2009-2957",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-2957",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200909-036",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-002070"
},
{
"db": "NVD",
"id": "CVE-2009-2957"
},
{
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request. Dnsmasq is prone to a remotely exploitable heap-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it into an insufficiently sized memory buffer. \nRemote attackers can exploit this issue to execute arbitrary machine code in the context of the vulnerable software on the targeted user\u0027s computer. \nVersions *prior to* Dnsmasq 2.50 are vulnerable. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- ------------------------------------------------------------------------\nDebian Security Advisory DSA-1876-1 security@debian.org\nhttp://www.debian.org/security/ Florian Weimer\nSeptember 01, 2009 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : dnsmasq\nVulnerability : buffer overflow\nProblem type : remote\nDebian-specific: no\nCVE Id(s) : CVE-2009-2957 CVE-2009-2958\n\nSeveral remote vulnerabilities have been discovered in the TFTP\ncomponent of dnsmasq. \n\nCVE-2009-2958\n Malicious TFTP clients may crash dnsmasq, leading to denial of\n service. \n\nThe old stable distribution is not affected by these problems. \n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.45-1+lenny1. \n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.50-1. \n\nWe recommend that you upgrade your dnsmasq packages. \n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file. \n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration. \n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45.orig.tar.gz\n Size/MD5 checksum: 377466 59106495260bb2d0f184f0d4ae88d740\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1.diff.gz\n Size/MD5 checksum: 14514 c841708d86ea6a13f4f168d311638ff5\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1.dsc\n Size/MD5 checksum: 1006 377658fb3cb46cc670a86e475ff70533\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1_all.deb\n Size/MD5 checksum: 12110 716c6f4f6e478f5a0f248725e4544dda\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_alpha.deb\n Size/MD5 checksum: 267294 d7ba6bd2b7363246587cf4ab8b78f721\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_amd64.deb\n Size/MD5 checksum: 258118 3b5fc290f6bfacd7450fbc138e63bcb7\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_arm.deb\n Size/MD5 checksum: 250676 0011c21826ab5f3b9c64444113acc97f\n\narmel architecture (ARM EABI)\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_armel.deb\n Size/MD5 checksum: 252830 5999eff243a849fe31fba765e92228d0\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_hppa.deb\n Size/MD5 checksum: 258292 cadea4880ef01292affd271cde276226\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_i386.deb\n Size/MD5 checksum: 251182 cdad8cd873dc28fd69fdd7ca2e59cec1\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_ia64.deb\n Size/MD5 checksum: 301522 2723ddacd61bf4378115a1701848fa2c\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_mips.deb\n Size/MD5 checksum: 256426 0873691aa0b37c2873e93e1132d0db95\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_mipsel.deb\n Size/MD5 checksum: 257982 dd6342a053fc0bb9a3be6ec5b4aa3b2f\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_powerpc.deb\n Size/MD5 checksum: 257426 58e705f584e41b2598a6d62bfc7e2671\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_s390.deb\n Size/MD5 checksum: 255328 3abfb764f944344064aed16352156b04\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_sparc.deb\n Size/MD5 checksum: 252234 4a6db5969b47698346b59828928dc0b5\n\n\n These files will probably be moved into the stable distribution on\n its next update. \n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show \u003cpkg\u003e\u0027 and http://packages.debian.org/\u003cpkg\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.9 (GNU/Linux)\n\niQEcBAEBAgAGBQJKnXmhAAoJEL97/wQC1SS+BPQIAK1x7nctuD1BkdIVjSt5BXRG\ncBlfdwgsyjXLoLocyN6A1lsHwcAcFPZI189aqLD2MU8MBJmugDdgReF4d6GTLI/T\nzv2G0fkj9rggJXAeqpFOlMK/nhUNxRDAn8h/ZgXcFuTkY0zm1M2D1qhqKpvOjByC\nU7im5+V/rp9VAFOaTdMnnvnBJX2nRnXULj85eIAaJYZSahX544UfKi6GLkjN0wji\nb/FJvtn9yOT6Rkzgs528icZ3ZoDslTV8xQhuBgILhCcP5Dmp7JokbdzZ7h3zH1YV\n8b0WwxEIF/mhmhlNVYDP6n2k2jLw+zLBF2c5jSIlHa67vChsLGeU3auqXAHMpq0=\n=h2eE\n-----END PGP SIGNATURE-----\n. ===========================================================\nUbuntu Security Notice USN-827-1 September 01, 2009\ndnsmasq vulnerabilities\nCVE-2009-2957, CVE-2009-2958\n===========================================================\n\nA security issue affects the following Ubuntu releases:\n\nUbuntu 8.04 LTS\nUbuntu 8.10\nUbuntu 9.04\n\nThis advisory also applies to the corresponding versions of\nKubuntu, Edubuntu, and Xubuntu. \n\nThe problem can be corrected by upgrading your system to the\nfollowing package versions:\n\nUbuntu 8.04 LTS:\n dnsmasq-base 2.41-2ubuntu2.2\n\nUbuntu 8.10:\n dnsmasq-base 2.45-1ubuntu1.1\n\nUbuntu 9.04:\n dnsmasq-base 2.47-3ubuntu0.1\n\nIn general, a standard system upgrade is sufficient to effect the\nnecessary changes. \n\nDetails follow:\n\nIvAin Arce, Pablo HernAin Jorge, Alejandro Pablo Rodriguez, MartA\\xadn Coco,\nAlberto SoliAto Testa and Pablo Annetta discovered that Dnsmasq did not\nproperly validate its input when processing TFTP requests for files with\nlong names. Dnsmasq runs as the \u0027dnsmasq\u0027 user by\ndefault on Ubuntu. (CVE-2009-2957)\n\nSteve Grubb discovered that Dnsmasq could be made to dereference a NULL\npointer when processing certain TFTP requests. ----------------------------------------------------------------------\n\nDo you have VARM strategy implemented?\n\n(Vulnerability Assessment Remediation Management) \n\nIf not, then implement it through the most reliable vulnerability\nintelligence source on the market. \n\nImplement it through Secunia. \n\nFor more information visit:\nhttp://secunia.com/advisories/business_solutions/\n\nAlternatively request a call from a Secunia representative today to\ndiscuss how we can help you with our capabilities contact us at:\nsales@secunia.com\n\n----------------------------------------------------------------------\n\nTITLE:\nUbuntu update for dnsmasq \n\nSECUNIA ADVISORY ID:\nSA36563\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/36563/\n\nDESCRIPTION:\nUbuntu has issued an update for dnsmasq. This fixes two\nvulnerabilities, which can be exploited by malicious people to cause\na DoS (Denial of Service) and potentially compromise a vulnerable\nsystem. \n\nFor more information:\nSA36394\n\nSOLUTION:\nApply updated packages. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 200909-19\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: Dnsmasq: Multiple vulnerabilities\n Date: September 20, 2009\n Bugs: #282653\n ID: 200909-19\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities in Dnsmasq might result in the remote\nexecution of arbitrary code, or a Denial of Service. \n\nBackground\n==========\n\nDnsmasq is a lightweight, easy to configure DNS forwarder and DHCP\nserver. It includes support for Trivial FTP (TFTP). \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 net-dns/dnsmasq \u003c 2.5.0 \u003e= 2.5.0\n\nDescription\n===========\n\nMultiple vulnerabilities have been reported in the TFTP functionality\nincluded in Dnsmasq:\n\n* Pablo Jorge and Alberto Solino discovered a heap-based buffer\n overflow (CVE-2009-2957). \n\n* An anonymous researcher reported a NULL pointer reference\n (CVE-2009-2958). \n\nImpact\n======\n\nA remote attacker in the local network could exploit these\nvulnerabilities by sending specially crafted TFTP requests to a machine\nrunning Dnsmasq, possibly resulting in the remote execution of\narbitrary code with the privileges of the user running the daemon, or a\nDenial of Service. NOTE: The TFTP server is not enabled by default. \n\nWorkaround\n==========\n\nYou can disable the TFTP server either at buildtime by not enabling the\n\"tftp\" USE flag, or at runtime. Make sure \"--enable-tftp\" is not set in\nthe DNSMASQ_OPTS variable in the /etc/conf.d/dnsmasq file and\n\"enable-tftp\" is not set in /etc/dnsmasq.conf, either of which would\nenable TFTP support if it is compiled in. \n\nResolution\n==========\n\nAll Dnsmasq users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose =net-dns/dnsmasq-2.5.0\n\nReferences\n==========\n\n [ 1 ] CVE-2009-2957\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2957\n [ 2 ] CVE-2009-2958\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2958\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-200909-19.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2009 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-2957"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-002070"
},
{
"db": "BID",
"id": "36121"
},
{
"db": "PACKETSTORM",
"id": "80904"
},
{
"db": "PACKETSTORM",
"id": "80907"
},
{
"db": "PACKETSTORM",
"id": "80932"
},
{
"db": "PACKETSTORM",
"id": "81475"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-2957",
"trust": 3.0
},
{
"db": "BID",
"id": "36121",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "36563",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2009-2487",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2009-002070",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200909-036",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "80904",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "80907",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "80932",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "81475",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "36121"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-002070"
},
{
"db": "PACKETSTORM",
"id": "80904"
},
{
"db": "PACKETSTORM",
"id": "80907"
},
{
"db": "PACKETSTORM",
"id": "80932"
},
{
"db": "PACKETSTORM",
"id": "81475"
},
{
"db": "NVD",
"id": "CVE-2009-2957"
},
{
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
]
},
"id": "VAR-200909-0349",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.24812031
},
"last_update_date": "2023-12-18T13:09:56.898000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "dnsmasq-2.45-1.1.1AXS3",
"trust": 0.8,
"url": "https://tsn.miraclelinux.com/tsn_local/index.php?m=errata\u0026a=detail\u0026eid=746"
},
{
"title": "CHANGELOG",
"trust": 0.8,
"url": "http://www.thekelleys.org.uk/dnsmasq/changelog"
},
{
"title": "RHSA-2009:1238",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2009-1238.html"
},
{
"title": "RHSA-2009:1238",
"trust": 0.8,
"url": "https://www.jp.redhat.com/support/errata/rhsa/rhsa-2009-1238j.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-002070"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-002070"
},
{
"db": "NVD",
"id": "CVE-2009-2957"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/36121"
},
{
"trust": 1.9,
"url": "http://www.coresecurity.com/content/dnsmasq-vulnerabilities"
},
{
"trust": 1.6,
"url": "http://www.thekelleys.org.uk/dnsmasq/changelog"
},
{
"trust": 1.6,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=519020"
},
{
"trust": 1.1,
"url": "http://www.ubuntu.com/usn/usn-827-1"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/36563"
},
{
"trust": 1.0,
"url": "http://www.redhat.com/support/errata/rhsa-2009-1238.html"
},
{
"trust": 1.0,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a10538"
},
{
"trust": 1.0,
"url": "https://rhn.redhat.com/errata/rhsa-2010-0095.html"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-2957"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-2957"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2009/2487"
},
{
"trust": 0.3,
"url": "http://www.thekelleys.org.uk/dnsmasq/doc.html"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-2957"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-2958"
},
{
"trust": 0.2,
"url": "http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2.2_powerpc.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.45-1ubuntu1.1.dsc"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2.2_i386.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.47-3ubuntu0.1.dsc"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45-1ubuntu1.1_all.deb"
},
{
"trust": 0.2,
"url": "http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1.1_sparc.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.41-2ubuntu2.2.dsc"
},
{
"trust": 0.2,
"url": "http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2.2_sparc.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0.1_i386.deb"
},
{
"trust": 0.2,
"url": "http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0.1_powerpc.deb"
},
{
"trust": 0.2,
"url": "http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0.1_lpia.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1.1_amd64.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1.1_i386.deb"
},
{
"trust": 0.2,
"url": "http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1.1_powerpc.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.45-1ubuntu1.1.diff.gz"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2.2_amd64.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0.1_amd64.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47-3ubuntu0.1_all.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41-2ubuntu2.2_all.deb"
},
{
"trust": 0.2,
"url": "http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0.1_sparc.deb"
},
{
"trust": 0.2,
"url": "http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1.1_lpia.deb"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.47-3ubuntu0.1.diff.gz"
},
{
"trust": 0.2,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.41-2ubuntu2.2.diff.gz"
},
{
"trust": 0.2,
"url": "http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2.2_lpia.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_i386.deb"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_sparc.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_s390.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_mipsel.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_alpha.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45.orig.tar.gz"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_ia64.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1.diff.gz"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_armel.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1.dsc"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+lenny1_all.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_powerpc.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_amd64.deb"
},
{
"trust": 0.1,
"url": "http://packages.debian.org/\u003cpkg\u003e"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_mips.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_hppa.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2.45-1+lenny1_arm.deb"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.47.orig.tar.gz"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.45.orig.tar.gz"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.41.orig.tar.gz"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.45.orig=2etar.gz"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/36563/"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.47.orig=2etar.gz"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/36394/"
},
{
"trust": 0.1,
"url": "http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq_2.41.orig=2etar.gz"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-200909-19.xml"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-2958"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
}
],
"sources": [
{
"db": "BID",
"id": "36121"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-002070"
},
{
"db": "PACKETSTORM",
"id": "80904"
},
{
"db": "PACKETSTORM",
"id": "80907"
},
{
"db": "PACKETSTORM",
"id": "80932"
},
{
"db": "PACKETSTORM",
"id": "81475"
},
{
"db": "NVD",
"id": "CVE-2009-2957"
},
{
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "36121"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-002070"
},
{
"db": "PACKETSTORM",
"id": "80904"
},
{
"db": "PACKETSTORM",
"id": "80907"
},
{
"db": "PACKETSTORM",
"id": "80932"
},
{
"db": "PACKETSTORM",
"id": "81475"
},
{
"db": "NVD",
"id": "CVE-2009-2957"
},
{
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-08-31T00:00:00",
"db": "BID",
"id": "36121"
},
{
"date": "2009-10-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-002070"
},
{
"date": "2009-09-02T03:47:52",
"db": "PACKETSTORM",
"id": "80904"
},
{
"date": "2009-09-02T03:50:48",
"db": "PACKETSTORM",
"id": "80907"
},
{
"date": "2009-09-02T05:25:50",
"db": "PACKETSTORM",
"id": "80932"
},
{
"date": "2009-09-21T17:23:52",
"db": "PACKETSTORM",
"id": "81475"
},
{
"date": "2009-09-02T15:30:01.407000",
"db": "NVD",
"id": "CVE-2009-2957"
},
{
"date": "2009-08-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-10-16T01:38:00",
"db": "BID",
"id": "36121"
},
{
"date": "2009-10-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-002070"
},
{
"date": "2017-09-19T01:29:22.453000",
"db": "NVD",
"id": "CVE-2009-2957"
},
{
"date": "2009-09-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "80904"
},
{
"db": "PACKETSTORM",
"id": "80907"
},
{
"db": "PACKETSTORM",
"id": "81475"
},
{
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "dnsmasq of tftp_request Vulnerability in arbitrary code execution in function",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-002070"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200909-036"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.