Description
Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.
Affected products
- Debian / debian_linux3.1 – 3.1
- Debian / debian_linux4.0 – 4.0
- OpenBSD / OpenBSD4.0 – 4.0
- OpenBSD / OpenBSD4.1 – 4.1
- OpenBSD / OpenBSD4.2 – 4.2
- RedHat / enterprise_linux2.1 – 2.1
- RedHat / enterprise_linux2.1 – 2.1
- RedHat / linux_advanced_workstation2.1 – 2.1
- sun / opensolarissnv_01 – snv_01
- sun / opensolarissnv_01 – snv_01
- sun / opensolarissnv_02 – snv_02
- sun / opensolarissnv_02 – snv_02
- sun / opensolarissnv_03 – snv_03
- sun / opensolarissnv_03 – snv_03
- sun / opensolarissnv_04 – snv_04
- sun / opensolarissnv_04 – snv_04
- sun / opensolarissnv_05 – snv_05
- sun / opensolarissnv_05 – snv_05
- sun / opensolarissnv_06 – snv_06
- sun / opensolarissnv_06 – snv_06
- sun / opensolarissnv_07 – snv_07
- sun / opensolarissnv_07 – snv_07
- sun / opensolarissnv_08 – snv_08
- sun / opensolarissnv_08 – snv_08
- sun / opensolarissnv_09 – snv_09
- sun / opensolarissnv_09 – snv_09
- sun / opensolarissnv_10 – snv_10
- sun / opensolarissnv_10 – snv_10
- sun / opensolarissnv_11 – snv_11
- sun / opensolarissnv_11 – snv_11
- sun / opensolarissnv_12 – snv_12
- sun / opensolarissnv_12 – snv_12
- sun / opensolarissnv_13 – snv_13
- sun / opensolarissnv_13 – snv_13
- sun / opensolarissnv_14 – snv_14
- sun / opensolarissnv_14 – snv_14
- sun / opensolarissnv_15 – snv_15
- sun / opensolarissnv_15 – snv_15
- sun / opensolarissnv_16 – snv_16
- sun / opensolarissnv_16 – snv_16
- sun / opensolarissnv_17 – snv_17
- sun / opensolarissnv_17 – snv_17
- sun / opensolarissnv_18 – snv_18
- sun / opensolarissnv_18 – snv_18
- sun / opensolarissnv_19 – snv_19
- sun / opensolarissnv_19 – snv_19
- sun / opensolarissnv_20 – snv_20
- sun / opensolarissnv_20 – snv_20
- sun / opensolarissnv_21 – snv_21
- sun / opensolarissnv_21 – snv_21
- sun / opensolarissnv_22 – snv_22
- sun / opensolarissnv_22 – snv_22
- sun / opensolarissnv_23 – snv_23
- sun / opensolarissnv_23 – snv_23
- sun / opensolarissnv_24 – snv_24
- sun / opensolarissnv_24 – snv_24
- sun / opensolarissnv_25 – snv_25
- sun / opensolarissnv_25 – snv_25
- sun / opensolarissnv_26 – snv_26
- sun / opensolarissnv_26 – snv_26
- sun / opensolarissnv_27 – snv_27
- sun / opensolarissnv_27 – snv_27
- sun / opensolarissnv_28 – snv_28
- sun / opensolarissnv_28 – snv_28
- sun / opensolarissnv_29 – snv_29
- sun / opensolarissnv_29 – snv_29
- sun / opensolarissnv_30 – snv_30
- sun / opensolarissnv_30 – snv_30
- sun / opensolarissnv_31 – snv_31
- sun / opensolarissnv_31 – snv_31
- sun / opensolarissnv_32 – snv_32
- sun / opensolarissnv_32 – snv_32
- sun / opensolarissnv_33 – snv_33
- sun / opensolarissnv_33 – snv_33
- sun / opensolarissnv_34 – snv_34
- sun / opensolarissnv_34 – snv_34
- sun / opensolarissnv_35 – snv_35
- sun / opensolarissnv_35 – snv_35
- sun / opensolarissnv_36 – snv_36
- sun / opensolarissnv_36 – snv_36
- sun / opensolarissnv_37 – snv_37
- sun / opensolarissnv_37 – snv_37
- sun / opensolarissnv_38 – snv_38
- sun / opensolarissnv_38 – snv_38
- sun / opensolarissnv_39 – snv_39
- sun / opensolarissnv_39 – snv_39
- sun / opensolarissnv_40 – snv_40
- sun / opensolarissnv_40 – snv_40
- sun / opensolarissnv_41 – snv_41
- sun / opensolarissnv_41 – snv_41
- sun / opensolarissnv_42 – snv_42
- sun / opensolarissnv_42 – snv_42
- sun / opensolarissnv_43 – snv_43
- sun / opensolarissnv_43 – snv_43
- sun / opensolarissnv_44 – snv_44
- sun / opensolarissnv_44 – snv_44
- sun / opensolarissnv_45 – snv_45
- sun / opensolarissnv_45 – snv_45
- sun / opensolarissnv_46 – snv_46
- sun / opensolarissnv_46 – snv_46
- sun / opensolarissnv_47 – snv_47
- sun / opensolarissnv_47 – snv_47
- sun / opensolarissnv_48 – snv_48
- sun / opensolarissnv_48 – snv_48
- sun / opensolarissnv_49 – snv_49
- sun / opensolarissnv_49 – snv_49
- sun / opensolarissnv_50 – snv_50
- sun / opensolarissnv_50 – snv_50
- sun / opensolarissnv_51 – snv_51
- sun / opensolarissnv_51 – snv_51
- sun / opensolarissnv_52 – snv_52
- sun / opensolarissnv_52 – snv_52
- sun / opensolarissnv_53 – snv_53
- sun / opensolarissnv_53 – snv_53
- sun / opensolarissnv_54 – snv_54
- sun / opensolarissnv_54 – snv_54
- sun / opensolarissnv_55 – snv_55
- sun / opensolarissnv_55 – snv_55
- sun / opensolarissnv_56 – snv_56
- sun / opensolarissnv_56 – snv_56
- sun / opensolarissnv_57 – snv_57
- sun / opensolarissnv_57 – snv_57
- sun / opensolarissnv_58 – snv_58
- sun / opensolarissnv_58 – snv_58
- sun / opensolarissnv_59 – snv_59
- sun / opensolarissnv_59 – snv_59
- sun / opensolarissnv_60 – snv_60
- sun / opensolarissnv_60 – snv_60
- sun / opensolarissnv_61 – snv_61
- sun / opensolarissnv_61 – snv_61
- sun / opensolarissnv_62 – snv_62
- sun / opensolarissnv_62 – snv_62
- sun / opensolarissnv_63 – snv_63
- sun / opensolarissnv_63 – snv_63
- sun / opensolarissnv_64 – snv_64
- sun / opensolarissnv_64 – snv_64
- sun / opensolarissnv_65 – snv_65
- sun / opensolarissnv_65 – snv_65
- sun / opensolarissnv_66 – snv_66
- sun / opensolarissnv_66 – snv_66
- sun / opensolarissnv_67 – snv_67
- sun / opensolarissnv_67 – snv_67
- sun / opensolarissnv_68 – snv_68
- sun / opensolarissnv_68 – snv_68
- sun / opensolarissnv_69 – snv_69
- sun / opensolarissnv_69 – snv_69
- sun / opensolarissnv_70 – snv_70
- sun / opensolarissnv_70 – snv_70
- sun / opensolarissnv_71 – snv_71
- sun / opensolarissnv_71 – snv_71
- sun / opensolarissnv_72 – snv_72
- sun / opensolarissnv_72 – snv_72
- sun / opensolarissnv_73 – snv_73
- sun / opensolarissnv_73 – snv_73
- sun / opensolarissnv_74 – snv_74
- sun / opensolarissnv_74 – snv_74
- sun / opensolarissnv_75 – snv_75
- sun / opensolarissnv_75 – snv_75
- sun / opensolarissnv_76 – snv_76
- sun / opensolarissnv_76 – snv_76
- sun / opensolarissnv_77 – snv_77
- sun / opensolarissnv_77 – snv_77
- sun / opensolarissnv_78 – snv_78
- sun / opensolarissnv_78 – snv_78
- sun / opensolarissnv_79 – snv_79
- sun / opensolarissnv_79 – snv_79
- sun / opensolarissnv_80 – snv_80
- sun / opensolarissnv_80 – snv_80
- sun / opensolarissnv_81 – snv_81
- sun / opensolarissnv_81 – snv_81
- sun / opensolarissnv_82 – snv_82
- sun / opensolarissnv_82 – snv_82
- sun / opensolarissnv_83 – snv_83
- sun / opensolarissnv_83 – snv_83
- sun / opensolarissnv_84 – snv_84
- sun / opensolarissnv_84 – snv_84
- sun / opensolarissnv_85 – snv_85
- sun / opensolarissnv_85 – snv_85
- sun / opensolarissnv_86 – snv_86
- sun / opensolarissnv_86 – snv_86
- sun / opensolarissnv_87 – snv_87
- sun / opensolarissnv_87 – snv_87
- sun / opensolarissnv_88 – snv_88
- sun / opensolarissnv_88 – snv_88
- sun / opensolarissnv_89 – snv_89
- sun / opensolarissnv_89 – snv_89
- sun / opensolarissnv_90 – snv_90
- sun / opensolarissnv_90 – snv_90
- sun / opensolarissnv_91 – snv_91
- sun / opensolarissnv_91 – snv_91
- sun / opensolarissnv_92 – snv_92
- sun / opensolarissnv_92 – snv_92
- sun / opensolarissnv_93 – snv_93
- sun / opensolarissnv_93 – snv_93
- sun / opensolarissnv_94 – snv_94
- sun / opensolarissnv_94 – snv_94
- sun / opensolarissnv_95 – snv_95
- sun / opensolarissnv_95 – snv_95
- sun / opensolarissnv_96 – snv_96
- sun / opensolarissnv_96 – snv_96
- sun / opensolarissnv_97 – snv_97
- sun / opensolarissnv_97 – snv_97
- sun / opensolarissnv_98 – snv_98
- sun / opensolarissnv_98 – snv_98
- sun / opensolarissnv_99 – snv_99
- sun / opensolarissnv_99 – snv_99
- sun / opensolarissnv_100 – snv_100
- sun / opensolarissnv_100 – snv_100
- sun / opensolarissnv_101 – snv_101
- sun / opensolarissnv_101 – snv_101
- sun / opensolarissnv_102 – snv_102
- sun / opensolarissnv_102 – snv_102
- sun / solaris8.0 – 8.0
- sun / solaris8.0 – 8.0
- sun / solaris9.0 – 9.0
- sun / solaris9.0 – 9.0
- sun / solaris10.0 – 10.0
- sun / solaris10.0 – 10.0
- Ubuntu / ubuntu_linux6.06 – 6.06
- Ubuntu / ubuntu_linux6.10 – 6.10
- Ubuntu / ubuntu_linux7.04 – 7.04
- Ubuntu / ubuntu_linux7.10 – 7.10
References
- VENDOR_ADVISORYhttp://secunia.com/advisories/27338
- VENDOR_ADVISORYhttp://secunia.com/advisories/27350
- VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2008/3088
- EXPLOIThttps://www.exploit-db.com/exploits/4601
- MISChttp://www.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/dhcpd/options.c
- VENDOR_ADVISORYhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446354
- MISChttp://www.openbsd.org/errata42.html#001_dhcpd
- MISChttp://www.securityfocus.com/bid/25984
- MISChttp://www.securityfocus.com/archive/1/483230/100/100/threaded
- MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/37045
- MISChttp://www.redhat.com/support/errata/RHSA-2007-0970.html
- VENDOR_ADVISORYhttp://www.debian.org/security/2007/dsa-1388
- MISChttp://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1962
- VENDOR_ADVISORYhttp://www.ubuntu.com/usn/usn-531-1
- MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5817
- VENDOR_ADVISORYhttp://www.ubuntu.com/usn/usn-531-2
- VENDOR_ADVISORYhttp://secunia.com/advisories/27160
- MISChttp://www.securityfocus.com/archive/1/482085/100/100/threaded
- VENDOR_ADVISORYhttp://secunia.com/advisories/27273
- MISChttp://www.openbsd.org/errata40.html#016_dhcpd
- MISChttp://sunsolve.sun.com/search/document.do?assetkey=1-26-243806-1
- VENDOR_ADVISORYhttp://secunia.com/advisories/32668
- MISChttp://www.openbsd.org/errata41.html#010_dhcpd
- MISChttp://sunsolve.sun.com/search/document.do?assetkey=1-21-109077-21-1
- MISChttp://www.securitytracker.com/id?1018794
- MISChttp://securitytracker.com/id?1021157
- MISChttp://www.securityfocus.com/bid/32213