PT-2009-6673 · Isc+1 · Dhcp3-Relay+8

Christoph Biedl · Published 1970-01-01 · Updated 2024-06-15 · CVE-2009-1892

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dhcp3-server versions 3.0.4 through 3.1.1 dhcp version prior to 3.1.2 p1 dhcp3-client (affected versions not specified) dhcp3-relay (affected versions not specified) dhcp3-dev (affected versions not specified) dhcp3-client-udeb (affected versions not specified) dhcp3-server-ldap (affected versions not specified) dhcp3-common (affected versions not specified)

Description The issue involves multiple vulnerabilities in the DHCP package of Debian GNU/Linux, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The vulnerabilities in dhcpd, when the dhcp-client-identifier and hardware ethernet configuration settings are both used, allow remote attackers to cause a denial of service via unspecified requests.

Recommendations For dhcp3-server versions 3.0.4 through 3.1.1, update to a version later than 3.1.1. For dhcp version prior to 3.1.2 p1, update to version 3.1.2 p1 or later. For dhcp3-client, dhcp3-relay, dhcp3-dev, dhcp3-client-udeb, dhcp3-server-ldap, and dhcp3-common, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-16

Related Identifiers

BDU:2015-01985

BDU:2015-01986

BDU:2015-01987

BDU:2015-01988

BDU:2015-01989

BDU:2015-02011

BDU:2015-02012

BDU:2015-02013

BDU:2015-09395

CVE-2009-1892

DSA-1833-2

OPENSUSE-SU-2024:10358-1

Affected Products

Debian

Dhcp

Dhcp3-Client

Dhcp3-Client-Udeb

Dhcp3-Common

Dhcp3-Dev

Dhcp3-Relay

Dhcp3-Server

Dhcp3-Server-Ldap

References · 44

• https://bdu.fstec.ru/vul/2015-01988 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-1892 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09395 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1892 · Security Note
• https://bdu.fstec.ru/vul/2015-01985 · Security Note
• https://bdu.fstec.ru/vul/2015-02013 · Security Note
• http://secunia.com/advisories/35851 · Vendor Advisory
• http://secunia.com/advisories/35830 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02012 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0692 · Security Note
• https://bdu.fstec.ru/vul/2015-02011 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1892 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-August/msg01177.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1892 · Security Note
• https://bdu.fstec.ru/vul/2015-01989 · Security Note