PT-2004-1583 · Isc · Isc Dhcp

David Hankins + 2 · Publicado 2004-06-24 · Atualizado 2017-07-11 · CVE-2004-0461

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ISC DHCP versions 3.0.1rc12 through 3.0.1rc13

Description The issue arises when the DHCP daemon (DHCPD) for ISC DHCP is compiled in environments lacking the vsnprintf function, leading to the use of C include files that define vsnprintf to use the less safe vsprintf function. This can result in buffer overflow vulnerabilities, enabling a denial of service (server crash) and possibly allowing the execution of arbitrary code.

Recommendations For versions 3.0.1rc12 and 3.0.1rc13, consider compiling the DHCP daemon in an environment that provides the vsnprintf function to mitigate the risk of buffer overflow vulnerabilities. As a temporary workaround, restrict access to the DHCP service to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-0461

Produtos afetados

Isc Dhcp

Referências · 12

• http://secunia.com/advisories/23265 · Nota
• http://marc.info/?l=bugtraq&m=108795911203342&w=2 · Nota
• http://kb.cert.org/vuls/id/654390 · Nota
• http://securityfocus.com/bid/10591 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16476 · Nota
• http://us-cert.gov/cas/techalerts/TA04-174A.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0461 · Nota de Segurança
• http://novell.com/linux/security/advisories/2004_19_dhcp_server.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108843959502356&w=2 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2004:061 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108938625206063&w=2 · Nota
• http://xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf · Nota