PT-2013-1259 · Isc+1 · Isc Dhcp+1

Published 2013-03-28 · Updated 2014-11-27 · CVE-2013-2494

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:H/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ISC DHCP versions 4.2.x through 4.2.5-P1 dhcp versions prior to 4.2.5 p1

Description The issue allows remote name servers to cause a denial of service, specifically memory consumption, via vectors involving a regular expression. This can be demonstrated by a memory-exhaustion attack against a machine running a dhcpd process. The exploitation of this issue may lead to disruption of protected information and can be carried out remotely by an attacker who has passed the authentication procedure.

Recommendations For ISC DHCP versions 4.2.x through 4.2.5-P1, update to version 4.2.5-P1 or later. For dhcp versions prior to 4.2.5 p1, update to version 4.2.5 p1 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2014-2398

BDU:2015-09739

CVE-2013-2494

Affected Products

Alt Linux

Isc Dhcp

References · 13

• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2494 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2494 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-2398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2494 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-2494 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-2494 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09739 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-2494 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2494 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-2494 · Vendor Advisory
• https://kb.isc.org/article/AA-00880 · Vendor Advisory
• https://packages.altlinux.org/ru/vuln/CVE-2013-2494 · Note
• http://security.gentoo.org/glsa/glsa-201401-05.xml · Note