Detections
Analytics
OracleVM 2.1 : dnsmasq (OVMSA-2009-0022)
medium Nessus Plugin ID 79464
Language:
Synopsis
The remote OracleVM host is missing a security update.Description
The remote OracleVM system is missing necessary patches to address critical security updates :CVE-2009-2957 Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request.
CVE-2009-2958 The tftp_request function in tftp.c in dnsmasq before 2.50, when
--enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.
- problems with strings when enabling tftp (CVE-2009-2957, CVE-2009-2957)
- Resolves: rhbg#519021
- update to new upstream version
- fixes for CVE-2008-1447/CERT VU#800113
- Resolves: rhbz#454869
Solution
Update the affected dnsmasq package.See Also
Plugin Details
Severity: Medium
ID: 79464
File Name: oraclevm_OVMSA-2009-0022.nasl
Version: 1.25
Type: local
Family: OracleVM Local Security Checks
Published: 11/26/2014
Updated: 1/14/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:oracle:vm:dnsmasq, cpe:/o:oracle:vm_server:2.1
Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/8/2009
Vulnerability Publication Date: 7/8/2008