#VU110634 NULL pointer dereference in Dnsmasq - CVE-2009-2958

Vulnerability identifier: #VU110634

Vulnerability risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2009-2958

CWE-ID: CWE-476

Exploitation vector: Local network

Exploit availability: Yes

Vulnerable software:
Dnsmasq
Server applications / DNS servers

Vendor: GNU

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the tftp_request() function in tftp.c. A remote attacker can trigger denial of service conditions via a TFTP read (aka RRQ) request with a malformed blksize option.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Dnsmasq: 2.40 - 2.49

---

External links
https://www.coresecurity.com/content/dnsmasq-vulnerabilities
https://www.redhat.com/support/errata/RHSA-2009-1238.html
https://www.securityfocus.com/bid/36120
https://www.thekelleys.org.uk/dnsmasq/CHANGELOG
https://www.ubuntu.com/usn/USN-827-1
https://bugzilla.redhat.com/show_bug.cgi?id=519020
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9816
https://rhn.redhat.com/errata/RHSA-2010-0095.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.