Multiple stack-based buffer overflows in the error handling routines of the minires library, as used in the NSUPDATE capability for ISC DHCPD 3.0 through 3.0.1RC10, allow remote attackers to execute arbitrary code via a DHCP message containing a long hostname.

The Internet Software Consortium discovered several vulnerabilities during an audit of the ISC DHCP Daemon. The vulnerabilities exist in error handling routines within the minires library and may be exploitable as stack overflows. This could allow a remote attacker to execute arbitrary code under the user id the dhcpd runs under, usually root. Other DHCP servers than dhcp3 doesn't seem to be affected.

The remote host is running a DHCP server. If it is ISC-DHCP, there might be several flaws in it that may allow an attacker to gain a root shell on this host.

Several potential vulnerabilities were detected by the ISC (Internet Software Consortium) in their dhcp server software. The vulnerabilities affect the minires library and may be exploitable as stack buffer overflows, which could lead to remote code execution. All Mandrake Linux users are encouraged to upgrade; only Mandrake Linux 8.0 came with dhcp 2.x and is not vulnerable.

ID	Name	Product	Family	Type	Severity
15068	Debian DSA-231-1 : dhcp3 - stack overflows	Nessus	Debian Local Security Checks	Local	high
1907	DHCP Server Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Generic		info
13992	Mandrake Linux Security Advisory : dhcp (MDKSA-2003:007)	Nessus	Mandriva Local Security Checks	Local	high

Detections

Analytics

CVE-2003-0026

critical

Tenable Plugins

high

info

high