PT-2015-3954 · Roy Marples · Dhcpcd

Jüri Aedla · Published 2015-03-12 · Updated 2017-09-21 · CVE-2014-7912

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dhcpcd versions prior to 6.2.0 dhcpcd 5.x

Description The issue allows remote DHCP servers to execute arbitrary code or cause a denial of service due to memory corruption. This is possible because the get option function in dhcp.c does not validate the relationship between length fields and the amount of data. A large length value of an option in a DHCPACK message can trigger this issue.

Recommendations For dhcpcd versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue. For dhcpcd 5.x, consider disabling the get option function in dhcp.c as a temporary workaround until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-7912

DLA-506-1

ZDI-15-093

Affected Products

Dhcpcd

References · 11

• https://zerodayinitiative.com/advisories/ZDI-15-093 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-7912 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-7912 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-7912 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-7912 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-7912 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7912 · Vendor Advisory
• https://android.googlesource.com/platform/external/dhcpcd/+/73c09dd8067250734511d955d8f792b41c7213f0 · Note
• http://securitytracker.com/id/1033124 · Note
• http://zerodayinitiative.com/advisories/ZDI-15-093 · Note