PT-2002-1725 · Isc · Isc Dhcp Daemon

Published 2002-07-23 · Updated 2016-10-18 · CVE-2002-0702

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ISC DHCP daemon versions 3 to 3.0.1rc8

Description The issue concerns format string vulnerabilities in the logging routines for dynamic DNS code of the ISC DHCP daemon. This vulnerability can be exploited by remote malicious DNS servers when the NSUPDATE option is enabled, allowing them to execute arbitrary code via format strings in a DNS server response.

Recommendations For ISC DHCP daemon versions 3 to 3.0.1rc8, consider disabling the NSUPDATE option as a temporary workaround until a patch is available. Restrict access to the dynamic DNS code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-0702

Affected Products

Isc Dhcp Daemon

References · 12

• 🔥 https://exploit-db.com/exploits/21440 · Exploit
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-037.php · Vendor Advisory
• http://cert.org/advisories/CA-2002-12.html · Patch
• http://iss.net/security_center/static/9039.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0702 · Security Note
• http://securityfocus.com/bid/4701 · Vendor Advisory
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-028.0.txt · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000483 · Vendor Advisory
• http://novell.com/linux/security/advisories/2002_19_dhcp.html · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0063.html · Note
• http://marc.info/?l=bugtraq&m=102089498828206&w=2 · Note
• http://kb.cert.org/vuls/id/854315 · Note