Back to Database
Status published
Medium
CVE-2009-2958
The tftp_request function in tftp.c in dnsmasq before 2.50, when...
Vulnerability Description
The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-2958
Credits & Attribution
No credits recorded in the NVD database.
References
- http://secunia.com/advisories/36563
- http://www.ubuntu.com/usn/USN-827-1
- https://bugzilla.redhat.com/show_bug.cgi?id=519020
- http://www.securityfocus.com/bid/36120
- http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9816
- http://www.coresecurity.com/content/dnsmasq-vulnerabilities
- https://rhn.redhat.com/errata/RHSA-2010-0095.html
- http://www.redhat.com/support/errata/RHSA-2009-1238.html
More from thekelleys
View All →CVE-2021-45957
Dnsmasq 2.86 has a heap-based buffer overflow in answer_request (called...
Critical
9.8
CVE-2021-45956
Dnsmasq 2.86 has a heap-based buffer overflow in print_mac (called...
Unknown
0
CVE-2021-45955
Dnsmasq 2.86 has a heap-based buffer overflow in resize_packet (called...
Critical
9.8
CVE-2021-45954
Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called...
Critical
9.8
CVE-2021-45953
Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called...
Critical
9.8
Affected Vendor
thekelleys
View all reports →Affected Software
dnsmasq
Vulnerable Versions:
0, 0.4, 0.5, 0.6, 0.7, 0.95, 0.96, 0.98, 0.992, 0.996, 1.0, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16, 1.17, 1.18, 2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.11, 2.12, 2.13, 2.14, 2.15, 2.16, 2.17, 2.18, 2.19, 2.20, 2.21, 2.22, 2.23, 2.24, 2.25, 2.26, 2.27, 2.28, 2.29, 2.30, 2.31, 2.33, 2.34, 2.35, 2.36, 2.37, 2.38, 2.39, 2.40, 2.41, 2.42, 2.43, 2.44, 2.45, 2.46, 2.47, 2.48
Timeline
Official Publish:
September 2nd, 2009
Last Modified:
August 7th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.