RHEL 2.1 : dhcp (RHSA-2007:0970)

This script is Copyright (C) 2007-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

An updated dhcp package that corrects a security flaw is now available
for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the
Red Hat Security Response Team.

The dhcp package provides the ISC Dynamic Host Configuration Protocol
(DHCP) server and relay agent, dhcpd. DHCP is a protocol that allows
devices to get their own network configuration information from a
server.

A bug was found in the way dhcpd validates certain DHCP protocol
options. A malicious DHCP client could send a carefully crafted DHCP
request and cause dhcpd to crash or possibly execute arbitrary code.
(CVE-2007-5365)

All users of dhcp should upgrade to this updated package, which
contains a backported patch that resolves this issue.

See also :

https://www.redhat.com/security/data/cve/CVE-2007-0063.html
https://www.redhat.com/security/data/cve/CVE-2007-5365.html
http://rhn.redhat.com/errata/RHSA-2007-0970.html

Solution :

Update the affected dhcp package.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 27566 ()

Bugtraq ID:

CVE ID: CVE-2007-0063
CVE-2007-5365

Ready to Scan Unlimited IPs & Run Compliance Checks?

Upgrade to Nessus Professional today!

Buy Now

Combine the Power of Nessus with the Ease of Cloud

Start your free Nessus Cloud trial now!

Begin Free Trial