This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.
The remote Gentoo host is missing one or more security-related
The remote host is affected by the vulnerability described in GLSA-200909-19
(Dnsmasq: Multiple vulnerabilities)
Multiple vulnerabilities have been reported in the TFTP functionality
included in Dnsmasq:
Pablo Jorge and Alberto Solino
discovered a heap-based buffer overflow (CVE-2009-2957).
anonymous researcher reported a NULL pointer reference
A remote attacker in the local network could exploit these
vulnerabilities by sending specially crafted TFTP requests to a machine
running Dnsmasq, possibly resulting in the remote execution of
arbitrary code with the privileges of the user running the daemon, or a
Denial of Service. NOTE: The TFTP server is not enabled by default.
You can disable the TFTP server either at buildtime by not enabling the
'tftp' USE flag, or at runtime. Make sure '--enable-tftp' is not set in
the DNSMASQ_OPTS variable in the /etc/conf.d/dnsmasq file and
'enable-tftp' is not set in /etc/dnsmasq.conf, either of which would
enable TFTP support if it is compiled in.
See also :
All Dnsmasq users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=net-dns/dnsmasq-2.5.0'
Risk factor :
Medium / CVSS Base Score : 6.8
CVSS Temporal Score : 5.9
Public Exploit Available : true