SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#410676

ISC DHCP dhclient stack buffer overflow

Overview

The ISC DHCP dhclient application contains a stack buffer overflow, which may allow a remote, unauthenticated attacker to execute arbitrary code with root privileges.

I. Description

As described in RFC 2131, "The Dynamic Host Configuration Protocol (DHCP) provides a framework for passing configuration information to hosts on a TCP/IP network." ISC DHCP is a reference implementation of the DHCP protocol, including a DHCP server, client, and relay agent.

The ISC DHCP client code (dhclient) contains a stack buffer overflow in the script_write_params() method. dhclient fails to check the length of the server-supplied subnet-mask option before copying it into a buffer. According to ISC, the following versions are affected:

    DHCP 4.1 (all versions)
    DHCP 4.0 (all versions)
    DHCP 3.1 (all versions)
    DHCP 3.0 (all versions)
    DHCP 2.0 (all versions)

II. Impact

A rogue DHCP server may be able to execute arbitrary code with root privileges on a vulnerable client system.

III. Solution

Apply a patch or update from your vendor

For vendor-specific information regarding vulnerable status and patch availability, please see the Systems Affected section of this document.

Upgrade your version of DHCP

Upgrade your system as specified by your vendor. If you need to upgrade DHCP manually, according to ISC:

    Upgrade to 4.1.0p1, 4.0.1p1, or 3.1.2p1

    There are no fixes planned for DHCP 3.0 or DHCP 2.0, as those release trains have reached End-Of-Life.

Systems Affected
VendorStatusDate NotifiedDate Updated
3com, Inc.Unknown2009-06-232009-06-23
ACCESSUnknown2009-06-232009-06-23
Alcatel-LucentUnknown2009-06-232009-06-23
Apple Inc.Not Vulnerable2009-06-232009-06-24
AT&TUnknown2009-06-232009-06-23
Avaya, Inc.Unknown2009-06-232009-06-23
Barracuda NetworksUnknown2009-06-232009-06-23
Belkin, Inc.Unknown2009-06-232009-06-23
Borderware TechnologiesUnknown2009-06-232009-06-23
BroUnknown2009-06-232009-06-23
Charlotte's Web NetworksUnknown2009-06-232009-06-23
Check Point Software TechnologiesUnknown2009-06-232009-06-23
Cisco Systems, Inc.Unknown2009-06-232009-06-23
ClavisterUnknown2009-06-232009-06-23
Computer AssociatesUnknown2009-06-232009-06-23
Computer Associates eTrust Security ManagementNot Vulnerable2009-06-232009-06-25
Conectiva Inc.Unknown2009-06-232009-06-23
Cray Inc.Unknown2009-06-232009-06-23
D-Link Systems, Inc.Unknown2009-06-262009-06-26
Debian GNU/LinuxUnknown2009-06-232009-06-23
DragonFly BSD ProjectUnknown2009-06-232009-06-23
EMC CorporationUnknown2009-06-232009-06-23
Engarde Secure LinuxUnknown2009-06-232009-06-23
Enterasys NetworksUnknown2009-06-232009-06-23
EricssonUnknown2009-06-232009-06-23
eSoft, Inc.Unknown2009-06-232009-06-23
Extreme NetworksUnknown2009-06-232009-06-23
F5 Networks, Inc.Unknown2009-06-232009-06-23
Fedora ProjectUnknown2009-06-232009-06-23
Force10 Networks, Inc.Not Vulnerable2009-06-232009-07-14
Fortinet, Inc.Unknown2009-06-232009-06-23
Foundry Networks, Inc.Unknown2009-06-232009-06-23
FreeBSD, Inc.Unknown2009-06-232009-06-23
FujitsuUnknown2009-06-232009-06-23
Gentoo LinuxVulnerable2009-06-232009-07-14
Global Technology AssociatesUnknown2009-06-232009-06-23
Hewlett-Packard CompanyUnknown2009-06-232009-06-23
HitachiUnknown2009-06-232009-06-23
IBM CorporationUnknown2009-06-242009-06-24
IBM eServerUnknown2009-06-232009-06-23
InfobloxNot Vulnerable2009-06-232009-07-29
Intel CorporationUnknown2009-06-232009-06-23
Internet Security Systems, Inc.Vulnerable2009-06-232009-07-15
Internet Systems ConsortiumUnknown2009-06-242009-06-24
Internet Systems Consortium - DHCPUnknown2009-06-242009-06-24
IntotoUnknown2009-06-232009-06-23
IP FilterUnknown2009-06-232009-06-23
Juniper Networks, Inc.Unknown2009-06-232009-06-23
Luminous NetworksUnknown2009-06-232009-06-23
m0n0wallUnknown2009-06-232009-06-23
Mandriva S. A.Unknown2009-06-232009-06-23
McAfeeUnknown2009-06-232009-06-23
Microsoft CorporationNot Vulnerable2009-06-232009-06-24
MontaVista Software, Inc.Unknown2009-06-232009-06-23
Multitech, Inc.Unknown2009-06-232009-06-23
NEC CorporationUnknown2009-06-232009-06-23
NetAppUnknown2009-06-232009-06-23
NetBSDVulnerable2009-06-232009-07-15
netfilterUnknown2009-06-232009-06-23
NokiaUnknown2009-06-252009-06-25
Nortel Networks, Inc.Unknown2009-06-232009-06-23
Novell, Inc.Unknown2009-06-232009-06-23
Openwall GNU/*/LinuxUnknown2009-06-232009-06-23
PePLinkNot Vulnerable2009-06-232009-07-20
Process SoftwareUnknown2009-06-232009-06-23
Q1 LabsUnknown2009-06-232009-06-23
QNX, Software Systems, Inc.Not Vulnerable2009-06-232009-07-07
QuaggaUnknown2009-06-232009-06-23
RadWare, Inc.Unknown2009-06-232009-06-23
Red Hat, Inc.Vulnerable2009-06-232009-07-16
Redback Networks, Inc.Unknown2009-06-232009-06-23
SafeNetNot Vulnerable2009-06-232009-07-03
Secureworx, Inc.Unknown2009-06-232009-06-23
Silicon Graphics, Inc.Unknown2009-06-232009-06-23
Slackware Linux Inc.Unknown2009-06-232009-06-23
SmoothWallNot Vulnerable2009-06-232009-06-25
SnortUnknown2009-06-232009-06-23
Soapstone NetworksUnknown2009-06-232009-06-23
Sony CorporationUnknown2009-06-232009-06-23
SourcefireUnknown2009-06-232009-06-23
StonesoftUnknown2009-06-232009-06-23
Sun Microsystems, Inc.Not Vulnerable2009-06-232009-06-26
SUSE LinuxUnknown2009-06-232009-06-23
SymantecUnknown2009-06-232009-06-23
The SCO GroupNot Vulnerable2009-06-232009-06-30
TippingPoint, Technologies, Inc.Unknown2009-06-232009-06-23
TurbolinuxUnknown2009-06-232009-06-23
U4EA Technologies, Inc.Unknown2009-06-232009-06-23
UbuntuVulnerable2009-06-232009-07-14
UnisysUnknown2009-06-232009-06-23
VMwareUnknown2009-06-292009-06-29
VyattaUnknown2009-06-232009-06-23
Watchguard Technologies, Inc.Unknown2009-06-232009-06-23
Wind River Systems, Inc.Not Vulnerable2009-06-232009-06-29
ZyXELUnknown2009-06-232009-06-23

References


https://www.isc.org/node/468

Credit

This vulnerability was reported by ISC, who in turn credit the Mandriva Linux Engineering Team with discovering and reporting the vulnerability.

This document was written by Will Dormann.

Other Information

Date Public:2009-07-14
Date First Published:2009-07-14
Date Last Updated:2009-07-29
CERT Advisory: 
CVE-ID(s):CVE-2009-0692
NVD-ID(s):CVE-2009-0692
US-CERT Technical Alerts: 
Metric:19.95
Document Revision:27

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2009 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader