PT-2004-1582 · Isc · Isc Dhcp

Gregory Duchemin + 1 · Publicado 2004-06-24 · Atualizado 2017-07-11 · CVE-2004-0460

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ISC DHCP versions 3.0.1rc12 through 3.0.1rc13

Description The issue is related to a buffer overflow in the logging capability for the DHCP daemon. This can be triggered by remote attackers sending multiple hostname options in various DHCP messages, such as DISCOVER, OFFER, REQUEST, ACK, or NAK messages. The vulnerability can cause a denial of service, resulting in a server crash, and potentially allow the execution of arbitrary code when a long string is generated while writing to a log file.

Recommendations For ISC DHCP versions 3.0.1rc12 and 3.0.1rc13, consider disabling the logging capability for the DHCP daemon until a patch is available. Restrict access to the DHCP daemon to minimize the risk of exploitation. Avoid using the hostname options in DHCP messages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-0460

Produtos afetados

Isc Dhcp

Referências · 12

• https://exchange.xforce.ibmcloud.com/vulnerabilities/16475 · Nota
• http://secunia.com/advisories/23265 · Nota
• http://kb.cert.org/vuls/id/317350 · Nota
• http://marc.info/?l=bugtraq&m=108795911203342&w=2 · Nota
• http://us-cert.gov/cas/techalerts/TA04-174A.html · Nota
• http://securityfocus.com/bid/10590 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0460 · Nota de Segurança
• http://novell.com/linux/security/advisories/2004_19_dhcp_server.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108843959502356&w=2 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2004:061 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108938625206063&w=2 · Nota
• http://xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf · Nota