The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in     Android before 5.1 and other products, misinterprets the return value of the snprintf function, which     allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via     a crafted message. (CVE-2014-7913)

Note that Nessus relies on the presence of the package as reported by the vendor.

Two vulnerabilities were discovered in dhcpcd5 a DHCP client package.
A remote (on a local network) attacker can possibly execute arbitrary code or cause a denial of service attack by crafted messages.

CVE-2014-7912

The get_option function does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.

CVE-2014-7913

The print_option function misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.

For Debian 7 'Wheezy', these problems have been fixed in version 5.5.6-1+deb7u2.

We recommend that you upgrade your dhcpcd5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE reports :

The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.

The Google Android operating system prior to 5.1.0 is affected by the following vulnerabilities

 - An overflow condition in the 'print_option()' function of the DHCP client daemon 'dhcp.c' is triggered when handling DHCP options. With a specially crafted ACK packet response, a context-dependent attacker can execute arbitrary code. (CVE-2014-7913) 
 - There is an integer overflow conditions in the 'GraphicBuffer::unflatten()' function in 'platform/frameworks/native/libs/ui/GraphicBuffer.cpp' related to a large number of file descriptors or integer values.  This may allow a malicious application to corrupt memory, causing a crash or potentially executing code with escalated privileges. (CVE-2015-1474)
 - There is an integer overflow condition in the 'BnAudioPolicyService::onTransact()' function in 'IAudioPolicyService.cpp'.  The issue is triggered as user-supplied input is not properly validated when handling a bound array size.  This may allow a local attacker to cause a buffer overflow, resulting in a denial of service or potentially execution of arbitrary code. (CVE-2015-1530)

ID	Name	Product	Family	Severity
254131	Linux Distros Unpatched Vulnerability : CVE-2014-7913	Nessus	Misc.	critical
91489	Debian DLA-506-1 : dhcpcd5 security update	Nessus	Debian Local Security Checks	medium
90554	FreeBSD : dhcpcd -- remote code execution/denial of service (6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1)	Nessus	FreeBSD Local Security Checks	medium
8666	Google Android Operating System < 5.1.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical

Detections

Analytics

CVE-2014-7913

critical

Tenable Plugins

critical

medium

medium

critical