PT-2002-1725 · Isc · Isc Dhcp Daemon

Publicado 2002-07-23 · Atualizado 2016-10-18 · CVE-2002-0702

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ISC DHCP daemon versions 3 to 3.0.1rc8

Description The issue concerns format string vulnerabilities in the logging routines for dynamic DNS code of the ISC DHCP daemon. This vulnerability can be exploited by remote malicious DNS servers when the NSUPDATE option is enabled, allowing them to execute arbitrary code via format strings in a DNS server response.

Recommendations For ISC DHCP daemon versions 3 to 3.0.1rc8, consider disabling the NSUPDATE option as a temporary workaround until a patch is available. Restrict access to the dynamic DNS code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2002-0702

Produtos afetados

Isc Dhcp Daemon

Referências · 12

• 🔥 https://exploit-db.com/exploits/21440 · Exploit
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0063.html · Nota
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-037.php · Aviso do Fabricante
• http://cert.org/advisories/CA-2002-12.html · Correção
• http://iss.net/security_center/static/9039.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0702 · Nota de Segurança
• http://securityfocus.com/bid/4701 · Aviso do Fabricante
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-028.0.txt · Aviso do Fabricante
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000483 · Aviso do Fabricante
• http://novell.com/linux/security/advisories/2002_19_dhcp.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=102089498828206&w=2 · Nota
• http://kb.cert.org/vuls/id/854315 · Nota