Signature Detail

DHCP: ISC DHCP Buffer Overflow Vulnerabilities

This signature detects attempts to exploit a known vulnerability in the ISC DHCP Daemon. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server.

Extended Description

ISC DHCPD is prone to a remotely exploitable buffer overflow vulnerability. This issue exists in routines responsible for logging hostname options provided by DHCP clients. Successful exploitation could result in execution of arbitrary code in the context of the DHCPD server. This issue is reported to affect ISC DHCPD versions 3.0.1rc12 and 3.0.1rc13. The vulnerable code exists in previous versions of ISC DHCPD 3, but is only believed to be exploitable in these two releases.

Affected Products

• Infoblox DNS One Appliance 2.3.1 -R5
• Infoblox DNS One Appliance 2.4.0 .0-8
• Infoblox DNS One Appliance 2.4.0 .0-8A
• ISC DHCPD 3.0.1 Rc12
• ISC DHCPD 3.0.1 Rc13
• Mandriva Linux Mandrake 10.0.0
• Mandriva Linux Mandrake 10.0.0 amd64
• Mandriva Linux Mandrake 9.0.0
• Mandriva Linux Mandrake 9.1.0
• Mandriva Linux Mandrake 9.1.0 Ppc
• Mandriva Linux Mandrake 9.2.0
• Mandriva Linux Mandrake 9.2.0 amd64
• Red Hat Fedora Core2
• SuSE Linux 8.0.0
• SuSE Linux 8.0.0 i386
• SuSE Linux 8.1.0
• SuSE Linux 9
• SuSE Linux 9.1
• SuSE Linux Admin-CD for Firewall
• SuSE Linux Connectivity Server
• SuSE Linux Database Server
• SuSE Linux Firewall on CD
• SuSE Linux Office Server
• SuSE Linux Personal 8.2.0
• SuSE Linux Personal 9.0.0
• SuSE Linux Personal 9.0.0 X86 64
• SuSE Linux Personal 9.1.0
• SuSE SuSE eMail Server III
• SuSE SUSE Linux Enterprise Server 7
• SuSE SUSE Linux Enterprise Server 8

References

• BugTraq: 10590
• CVE: CVE-2004-0460