Notified: November 26, 2002 Updated: March 26, 2003
Not Affected
Following CERT advisory CA-2003-01 on security vulnerabilities in the ISC DHCP implementation, Alcatel has conducted an immediate assessment to determine any impact this may have on our portfolio. A first analysis has shown that none of our products is impacted. The security of our customers' networks is of highest priority for Alcatel. Therefore we continue to test our product portfolio against potential ISC DHCP security vulnerabilities and will provide updates if necessary.
The vendor has not provided us with any further information regarding this vulnerability.
This statement was provided by Alcatel on February 24, 2003.
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
Mac OS X and Mac OS X Server do not contain the vulnerability described in this notice.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Affected
This vulnerability is addressed by the M431-001 and M500-004 patches for the 4.3.1 and 5.0 versions of BSD/OS.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
No Cisco products have been found to be affected by this vulnerability. Several Cisco products do utilize the ISC DHCPD, however, no Cisco products implement the ISC DHCPD NSUPDATE feature, nor do they include the minires library.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 28, 2003
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
Conectiva has published Conectiva Linux Security Advisory CLSA-2003:562 to address this issue. For more information, please see http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000562
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
Cray Inc. is not vulnerable as dhcpd is not supported on any of its products.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 20, 2003
Affected
Debian has updated their distribution with DSA 231. For the stable distribution (woody) this problem has been fixed in version 3.0+3.0.1rc9-2.1. The old stable distribution (potato) does not contain dhcp3 packages. For the unstable distribution (sid) this problem has been fixed in version 3.0+3.0.1rc11-1.
The vendor has not provided us with any further information regarding this vulnerability.
Debian Security Advisory DSA 231 is available at: http://www.debian.org/security/2003/dsa-231
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 20, 2003
Not Affected
Fujitsu's UXP/V OS is not vulnerable because it does not support the ISC DHCPD.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: January 17, 2003 Updated: January 20, 2003
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
Gentoo Linux has addressed this issue in Security Announcement 200301-10. For more details, see http://forums.gentoo.org/viewtopic.php?t=30721
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
Source: Hewlett-Packard Company Software Security Response Team cross reference id: SSRT2423 HP-UX - not vulnerable HP-MPE/ix - not vulnerable HP Tru64 UNIX - not vulnerable HP OpenVMS - not vulnerable HP NonStop Servers - not vulnerable To report potential security vulnerabilities in HP software, send an E-mail message to: mailto:security-alert@hp.com
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: January 07, 2003 Updated: January 15, 2003
Not Affected
We've checked up on our router (Hitachi,Ltd. GR2000 series) about [VU#284857]. Our DHCP implementation is NOT vulnerable.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
IBM's AIX does not ship with the ISC DHCP daemon. The issues discussed in VU#284857 or any following advisories based on this vulnerability note do not pertain to AIX.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: January 15, 2003 Updated: March 25, 2003
Not Affected
Ingrian Networks products are not vulnerable to VU#284857.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 16, 2002 Updated: January 15, 2003
Affected
We have a patched version of 3.0 available (3.0pl2) and a new release candidate for the next bug-fix release (3.0.1RC11). Both of these new releases are available from http://www.isc.org/products/DHCP/.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 20, 2003
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
MandrakeSoft has address this vulnerability in Security Advisory MDKSA-2003:007, available at http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:007
Notified: November 26, 2002 Updated: January 28, 2003
Not Affected
Microsoft products do not use the libraries in question. Microsoft products are not affected by this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
None of MontaVista Software's Linux products are vulnerable to this issue.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: January 15, 2003 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
[Server Products] * EWS/UP 48 Series operating system - is NOT vulnerable.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
Currently supported versions of NetBSD do not contain the error handling routine vulnerabilities. Such vulnerabilities were fixed prior to the release of NetBSD 1.5. With respect to the patch to ns_name.c, we believe that this is good defensive programming and have applied the patch to NetBSD-current. However, all calls to ns_name_ntol in the NetBSD source base pass a correct, constant, non-zero value as the datsiz parameter. Therefore, NetBSD is not vulnerable.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: January 08, 2003 Updated: January 15, 2003
Not Affected
NetScreen is not vulnerable to this issue.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
OpenBSD's dhcp support is much modified, does not have that feature, and therefore does not have that bug.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: January 16, 2003 Updated: January 20, 2003
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
OpenPKG has addressed this issue in Security Advisory OpenPKG-SA-2003.002, available at http://www.openpkg.org/security/OpenPKG-SA-2003.002-dhcpd.html
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
Openwall GNU/*/Linux is not vulnerable. We don't yet provide a DHCP suite.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: January 07, 2003 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Affected
Red Hat distributes a vulnerable version of ISC DHCP in Red Hat Linux 8.0. Other distributions of Red Hat Linux are not vulnerable to these issues. New DHCP packages are available along with our advisory at the URL below. Users of the Red Hat Network can update their systems using the 'up2date' tool. http://rhn.redhat.com/errata/RHSA-2003-011.html
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: January 07, 2003 Updated: January 15, 2003
Not Affected
Riverstone Networks is not vulnerable to VU#284857.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: January 19, 2003 Updated: January 21, 2003
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
Slackware has addressed this issue by releasing new DHCP packages for Slackware 8.1 . For more information, please see http://www.slackware.com/lists/archive/viewer.php?l=slackware-security&y=2003&m=slackware-security.198897
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Not Affected
Sun confirms that we are not vulnerable to the issues described in VU#284857. Solaris does not ship the ISC DHCPD and does not use any of the ISC DHCPD source in its version of DHCPD.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 20, 2003
Affected
We are preparing updates, that will be released soon.
The vendor has not provided us with any further information regarding this vulnerability.
SuSE has addressed this issue in Security Announcement SuSE-SA:2003:0006, available at http://www.suse.de/de/security/2003_006_dhcp.html
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: January 15, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: November 26, 2002 Updated: March 26, 2003
Not Affected
A response to this advisory is available from our web site: http://www.xerox.com/security.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.