Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

SunOS 5.10_x86: usr/lib/inet/in.dhcpd patc.
Date this patch was last updated by Sun : Nov/06/08

SunOS 5.10: usr/lib/inet/in.dhcpd patch.
Date this patch was last updated by Sun : Nov/06/08

USN-531-1 fixed vulnerabilities in dhcp. The fixes were incomplete, and only reduced the scope of the vulnerability, without fully solving it. This update fixes the problem.

Nahuel Riva and Gerardo Richarte discovered that the DHCP server did not correctly handle certain client options. A remote attacker could send malicious DHCP replies to the server and execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Nahuel Riva and Gerardo Richarte discovered that the DHCP server did not correctly handle certain client options. A remote attacker could send malicious DHCP replies to the server and execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated dhcp package that corrects a security flaw is now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The dhcp package provides the ISC Dynamic Host Configuration Protocol (DHCP) server and relay agent, dhcpd. DHCP is a protocol that allows devices to get their own network configuration information from a server.

A bug was found in the way dhcpd validates certain DHCP protocol options. A malicious DHCP client could send a carefully crafted DHCP request and cause dhcpd to crash or possibly execute arbitrary code.
(CVE-2007-5365)

All users of dhcp should upgrade to this updated package, which contains a backported patch that resolves this issue.

The patch used to correct the DHCP server buffer overflow in DSA-1388-1 was incomplete and did not adequately resolve the problem.
This update to the previous advisory makes updated packages based on a newer version of the patch available.

For completeness, please find below the original advisory :

It was discovered that dhcp, a DHCP server for automatic IP address assignment, didn't correctly allocate space for network replies. This could potentially allow a malicious DHCP client to execute arbitrary code upon the DHCP server.

SunOS 5.8: dhcp server and admin patch.
Date this patch was last updated by Sun : Nov/06/08

ID	Name	Product	Family	Severity
108006	Solaris 10 (x86) : 138877-01	Nessus	Solaris Local Security Checks	high
107508	Solaris 10 (sparc) : 138876-01	Nessus	Solaris Local Security Checks	high
28137	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : dhcp vulnerability (USN-531-2)	Nessus	Ubuntu Local Security Checks	critical
28136	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : dhcp vulnerability (USN-531-1)	Nessus	Ubuntu Local Security Checks	critical
27566	RHEL 2.1 : dhcp (RHSA-2007:0970)	Nessus	Red Hat Local Security Checks	critical
27515	Debian DSA-1388-3 : dhcp - buffer overflow	Nessus	Debian Local Security Checks	critical
13310	Solaris 8 (sparc) : 109077-21	Nessus	Solaris Local Security Checks	critical

Detections

Analytics

CVE-2007-5365

critical

Tenable Plugins

high

high

critical

critical

critical

critical

critical