Dnsmasq TFTP Service Remote NULL-Pointer Dereference Vulnerability

Bugtraq ID:	36120
Class:	Design Error
CVE:	CVE-2009-2958
Remote:	Yes
Local:	No
Published:	Aug 31 2009 12:00AM
Updated:	Apr 13 2015 09:25PM
Credit:	An anonymous researcher working with the vendor.
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 SuSE SUSE Linux Enterprise 11 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Pardus Linux 2009 0 Gentoo Linux Dnsmasq Dnsmasq 2.49 Dnsmasq Dnsmasq 2.48 Dnsmasq Dnsmasq 2.47 Dnsmasq Dnsmasq 2.46 Dnsmasq Dnsmasq 2.45 Dnsmasq Dnsmasq 2.44 Dnsmasq Dnsmasq 2.43 Dnsmasq Dnsmasq 2.42 Dnsmasq Dnsmasq 2.41 Dnsmasq Dnsmasq 2.40 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Dnsmasq Dnsmasq 2.50

Dnsmasq TFTP Service Remote NULL-Pointer Dereference Vulnerability

Dnsmasq is prone to a NULL-pointer dereference vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

NOTE: The TFTP service must be enabled for this issue to be exploitable; this is not the default.

Versions *prior to* Dnsmasq 2.50 are vulnerable.

Dnsmasq TFTP Service Remote NULL-Pointer Dereference Vulnerability

Attackers can use readily available networking tools to exploit this issue.

Dnsmasq TFTP Service Remote NULL-Pointer Dereference Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 ia-64

• Debian dnsmasq-base_2.45-1+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_ia64.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2 .2_powerpc.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1 .1_powerpc.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2 .2_sparc.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 5-1ubuntu1.1_i386.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Debian Linux 5.0 alpha

• Debian dnsmasq-base_2.45-1+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_alpha.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0 ia-32

• Debian dnsmasq-base_2.45-1+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_i386.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 1-2ubuntu2.2_amd64.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Debian Linux 5.0 s/390

• Debian dnsmasq-base_2.45-1+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_s390.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0 mipsel

• Debian dnsmasq-base_2.45-1+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_mipsel.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0 .1_sparc.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0 .1_powerpc.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_lpia.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2 .2_lpia.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1 .1_lpia.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Debian Linux 5.0 hppa

• Debian dnsmasq-base_2.45-1+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_hppa.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 7-3ubuntu0.1_i386.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Debian Linux 5.0 m68k

• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1 .1_sparc.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0 .1_lpia.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Debian Linux 5.0 arm

• Debian dnsmasq-base_2.45-1+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_arm.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0 armel

• Debian dnsmasq-base_2.45-1+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_armel.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0

• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 1-2ubuntu2.2_i386.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Debian Linux 5.0 amd64

• Debian dnsmasq-base_2.45-1+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_amd64.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0 mips

• Debian dnsmasq-base_2.45-1+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_mips.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 7-3ubuntu0.1_amd64.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Debian Linux 5.0 powerpc

• Debian dnsmasq-base_2.45-1+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_powerpc.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 5-1ubuntu1.1_amd64.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Debian Linux 5.0 sparc

• Debian dnsmasq-base_2.45-1+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_sparc.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Dnsmasq TFTP Service Remote NULL-Pointer Dereference Vulnerability

References:

• Dnsmasq Home Page (Dnsmasq)
  
• Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server (Core Security Technologies)