CVE-2009-2957: Buffer Overflow
Core Security Technologies discovered a heap overflow vulnerability in dnsmasq when the TFTP service is enabled ('--enable-tftp'). If the configured tftp-prefix is sufficiently long, and a remote user sent a request which sends a long file name, dnsmasq could crash or, possibly, execute arbitrary code with root privileges.
The default tftp-prefix is /var/tftpd, which is short enough to make this difficult to exploit; if a longer prefix is used then arbitrary code execution may be possible. As well, Red Hat does not have TFTP support enabled by default.
Other sources
Heap-based buffer overflow in the tftprequest function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2957?
CVE-2009-2957 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2009-2957?
To fix CVE-2009-2957, upgrade dnsmasq to version 2.50 or later.
Which versions of dnsmasq are affected by CVE-2009-2957?
CVE-2009-2957 affects dnsmasq versions prior to 2.50, including 0.4 to 2.49.
Can CVE-2009-2957 be exploited remotely?
Yes, CVE-2009-2957 can be exploited remotely through a crafted TFTP packet.
What symptoms indicate a potential CVE-2009-2957 exploitation?
Symptoms may include unexpected system behavior or crashes related to dnsmasq's TFTP service.