The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and     other products, does not validate the relationship between length fields and the amount of data, which     allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via     a large length value of an option in a DHCPACK message. (CVE-2014-7912)

Note that Nessus relies on the presence of the package as reported by the vendor.

Two vulnerabilities were discovered in dhcpcd5 a DHCP client package.
A remote (on a local network) attacker can possibly execute arbitrary code or cause a denial of service attack by crafted messages.

CVE-2014-7912

The get_option function does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.

CVE-2014-7913

The print_option function misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.

For Debian 7 'Wheezy', these problems have been fixed in version 5.5.6-1+deb7u2.

We recommend that you upgrade your dhcpcd5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE reports :

The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.

The Google Android operating system prior to 4.4.0 is affected by the following vulnerabilities:

 - There is a flaw in the built-in browser that is due to the improper handling of NULL bytes by the URL parser. This may allow a context-dependent attacker to bypass the same-origin policy. (CVE-2014-6041)
 - There is a flaw related to the 'addJavascriptInterface()' method and the 'accessibility' and 'accessibilityTraversal' objects.  With specially crafted JavaScript loaded within the WebView component, a remote attacker can execute arbitrary methods of Java objects i.e. achieve remote code execution. (CVE-2014-7224)
 - There is an overflow condition in the DHCP client daemon 'dhcp.c' that is triggered when handling DHCP options.  With a specially crafted ACK packet response, a context-dependent attacker can execute arbitrary code. (CVE-2014-7912)
 - There is a flaw in the Bluetooth application stack that is triggered when handling Host Controller Interface commands prior to pairing.  This may allow a remote attacker within short range of the device to force pairing and in turn execute arbitrary code. (CVE-2014-7914)

ID	Name	Product	Family	Severity
254357	Linux Distros Unpatched Vulnerability : CVE-2014-7912	Nessus	Misc.	critical
91489	Debian DLA-506-1 : dhcpcd5 security update	Nessus	Debian Local Security Checks	medium
90553	FreeBSD : dhcpcd -- remote code execution/denial of service (092156c9-04d7-11e6-b1ce-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
8664	Google Android Operating System < 4.4.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	medium

Detections

Analytics

CVE-2014-7912

critical

Tenable Plugins

critical

medium

medium

medium