ISC DHCPD minires library contains multiple buffer overflows

Overview

The Internet Software Consortium (ISC) has discovered several buffer overflow vulnerabilities in their implementation of DHCP (ISC DHCPD). These vulnerabilities may allow remote attackers to execute arbitrary code on affected systems. At this time, we are not aware of any exploits.

Description

There are multiple remote buffer overflow vulnerabilities in the ISC implementation of DHCP. As described in RFC 2131, “the Dynamic Host Configuration Protocol (DHCP) provides a framework for passing configuration information to hosts on a TCP/IP network.” In addition to supplying hosts with network configuration data, ISC DHCPD allows the DHCP server to dynamically update a DNS server, obviating the need for manual updates to the name server configuration. Support for dynamic DNS updates is provided by the NSUPDATE feature.

During an internal source code audit, developers from the ISC discovered several vulnerabilities in the error handling routines of the minires library, which is used by NSUPDATE to resolve hostnames. These vulnerabilities are stack-based buffer overflows that may be exploitable by sending a DHCP message containing a large hostname value. _Note: Although the minires library is derived from the BIND 8 resolver library, these vulnerabilities do not affect any current versions of BIND. _

---

Impact

Remote attackers may be able to execute arbitrary code with the privileges of the user running ISC DHCPD.

---

Solution

Upgrade or apply a patch

The ISC has addressed these vulnerabilities in versions 3.0pl2 and 3.0.1RC11 of ISC DHCPD. If your software vendor supplies ISC DHCPD as part of an operating system distribution, please see the vendor section of this document.

---

Disable dynamic DNS updates (NSUPDATE)

As an interim measure, the ISC recommends disabling the NSUPDATE feature on affected DHCP servers.

Block external access to DHCP server ports

As an interim measure, it is possible to limit exposure to these vulnerabilities by restricting external access to affected DHCP servers on the following ports:

bootps 67/tcp # Bootstrap Protocol Server bootps 67/udp # Bootstrap Protocol Server bootpc 68/tcp # Bootstrap Protocol Client bootpc 68/udp # Bootstrap Protocol Client

Disable the DHCP service

As a general rule, the CERT/CC recommends disabling any service or capability that is not explicitly required. Depending on your network configuration, you may not need to use DHCP.

---

Vendor Information

284857

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

BSDI __ Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Affected

Vendor Statement

This vulnerability is addressed by the M431-001 and M500-004 patches for the 4.3.1 and 5.0 versions of BSD/OS.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Conectiva __ Affected

Notified: November 26, 2002 Updated: January 28, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Conectiva has published Conectiva Linux Security Advisory CLSA-2003:562 to address this issue. For more information, please see

http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000562

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Debian __ Affected

Notified: November 26, 2002 Updated: January 20, 2003

Status

Affected

Vendor Statement

Debian has updated their distribution with DSA 231.

For the stable distribution (woody) this problem has been fixed in version 3.0+3.0.1rc9-2.1.

The old stable distribution (potato) does not contain dhcp3 packages.

For the unstable distribution (sid) this problem has been fixed in version 3.0+3.0.1rc11-1.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Debian Security Advisory DSA 231 is available at:

http://www.debian.org/security/2003/dsa-231

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Gentoo Linux __ Affected

Notified: January 17, 2003 Updated: January 20, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Gentoo Linux has addressed this issue in Security Announcement 200301-10. For more details, see

http://forums.gentoo.org/viewtopic.php?t=30721

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

ISC __ Affected

Notified: November 16, 2002 Updated: January 15, 2003

Status

Affected

Vendor Statement

We have a patched version of 3.0 available (3.0pl2) and a new release candidate for the next bug-fix release (3.0.1RC11). Both of these new releases are available from http://www.isc.org/products/DHCP/.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

MandrakeSoft __ Affected

Notified: November 26, 2002 Updated: January 20, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

MandrakeSoft has address this vulnerability in Security Advisory MDKSA-2003:007, available at

http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:007

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

OpenPKG __ Affected

Notified: January 16, 2003 Updated: January 20, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

OpenPKG has addressed this issue in Security Advisory OpenPKG-SA-2003.002, available at

http://www.openpkg.org/security/OpenPKG-SA-2003.002-dhcpd.html

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Red Hat Inc. __ Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Affected

Vendor Statement

Red Hat distributes a vulnerable version of ISC DHCP in Red Hat Linux 8.0. Other distributions of Red Hat Linux are not vulnerable to these issues. New DHCP packages are available along with our advisory at the URL below. Users of the Red Hat Network can update their systems using the ‘up2date’ tool.

_<http://rhn.redhat.com/errata/RHSA-2003-011.html&gt;_

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Slackware __ Affected

Notified: January 19, 2003 Updated: January 21, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Slackware has addressed this issue by releasing new DHCP packages for Slackware 8.1 . For more information, please see

http://www.slackware.com/lists/archive/viewer.php?l=slackware-security&y=2003&m=slackware-security.198897

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

SuSE Inc. __ Affected

Notified: November 26, 2002 Updated: January 20, 2003

Status

Affected

Vendor Statement

We are preparing updates, that will be released soon.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

SuSE has addressed this issue in Security Announcement SuSE-SA:2003:0006, available at

http://www.suse.de/de/security/2003_006_dhcp.html

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Alcatel __ Not Affected

Notified: November 26, 2002 Updated: March 26, 2003

Status

Not Affected

Vendor Statement

Following CERT advisory CA-2003-01 on security vulnerabilities in the ISC DHCP implementation, Alcatel has conducted an immediate assessment to determine any impact this may have on our portfolio. A first analysis has shown that none of our products is impacted. The security of our customers’ networks is of highest priority for Alcatel. Therefore we continue to test our product portfolio against potential ISC DHCP security vulnerabilities and will provide updates if necessary.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

This statement was provided by Alcatel on February 24, 2003.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Apple Computer Inc. __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

Mac OS X and Mac OS X Server do not contain the vulnerability described in this notice.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Cisco Systems Inc. __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

No Cisco products have been found to be affected by this vulnerability.

Several Cisco products do utilize the ISC DHCPD, however, no Cisco products implement the ISC DHCPD NSUPDATE feature, nor do they include the minires library.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Cray Inc. __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

Cray Inc. is not vulnerable as dhcpd is not supported on any of its products.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Fujitsu __ Not Affected

Notified: November 26, 2002 Updated: January 20, 2003

Status

Not Affected

Vendor Statement

Fujitsu’s UXP/V OS is not vulnerable because it does not support the ISC DHCPD.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Hewlett-Packard Company __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

Source: Hewlett-Packard Company Software Security Response Team

cross reference id: SSRT2423

HP-UX - not vulnerable
HP-MPE/ix - not vulnerable
HP Tru64 UNIX - not vulnerable
HP OpenVMS - not vulnerable
HP NonStop Servers - not vulnerable

To report potential security vulnerabilities in HP software, send an E-mail message to: mailto:[email protected]

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Hitachi __ Not Affected

Notified: January 07, 2003 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

We’ve checked up on our router (Hitachi,Ltd. GR2000 series) about [VU#284857]. Our DHCP implementation is NOT vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

IBM __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

IBM’s AIX does not ship with the ISC DHCP daemon. The issues discussed in VU#284857 or any following advisories based on this vulnerability note do not pertain to AIX.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Ingrian Networks __ Not Affected

Notified: January 15, 2003 Updated: March 25, 2003

Status

Not Affected

Vendor Statement

Ingrian Networks products are not vulnerable to VU#284857.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Microsoft Corporation __ Not Affected

Notified: November 26, 2002 Updated: January 28, 2003

Status

Not Affected

Vendor Statement

Microsoft products do not use the libraries in question. Microsoft products are not affected by this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

MontaVista Software __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

None of MontaVista Software’s Linux products are vulnerable to this issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

NEC Corporation __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

[Server Products]

• EWS/UP 48 Series operating system
  - is NOT vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

NetBSD __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

Currently supported versions of NetBSD do not contain the error handling routine vulnerabilities. Such vulnerabilities were fixed prior to the release of NetBSD 1.5.

With respect to the patch to ns_name.c, we believe that this is good defensive programming and have applied the patch to NetBSD-current. However, all calls to ns_name_ntol in the NetBSD source base pass a correct, constant, non-zero value as the datsiz parameter.

Therefore, NetBSD is not vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

NetScreen __ Not Affected

Notified: January 08, 2003 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

NetScreen is not vulnerable to this issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

OpenBSD __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

OpenBSD’s dhcp support is much modified, does not have that feature, and therefore does not have that bug.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Openwall GNU/*/Linux __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

Openwall GNU/*/Linux is not vulnerable. We don’t yet provide a DHCP suite.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Riverstone Networks __ Not Affected

Notified: January 07, 2003 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

Riverstone Networks is not vulnerable to VU#284857.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Sun Microsystems Inc. __ Not Affected

Notified: November 26, 2002 Updated: January 15, 2003

Status

Not Affected

Vendor Statement

Sun confirms that we are not vulnerable to the issues described in VU#284857. Solaris does not ship the ISC DHCPD and does not use any of the ISC DHCPD source in its version of DHCPD.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Xerox Corporation __ Not Affected

Notified: November 26, 2002 Updated: March 26, 2003

Status

Not Affected

Vendor Statement

A response to this advisory is available from our web site: http://www.xerox.com/security.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

AT&T Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Avaya Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Computer Associates Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

D-Link Systems Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Data General Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

F5 Networks Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

FreeBSD Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Guardian Digital Inc. Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Intel Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Juniper Networks Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Lachman Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Lotus Software Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Lucent Technologies Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Multi-Tech Systems Inc. Unknown

Notified: January 15, 2003 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Network Appliance Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Nokia Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Nortel Networks Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Redback Networks Inc. Unknown

Notified: January 07, 2003 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

SGI Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Sequent Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Sony Corporation Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

The SCO Group (SCO Linux) Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

The SCO Group (SCO UnixWare) Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Unisys Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Wind River Systems Inc. Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

Wirex Unknown

Notified: November 26, 2002 Updated: January 15, 2003

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23284857 Feedback>).

View all 55 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.isc.org/products/DHCP/&gt;
• <http://www.ietf.org/rfc/rfc2131.txt&gt;

Acknowledgements

The CERT Coordination Center thanks David Hankins of the Internet Software Consortium for notifying us about this problem and for helping us to construct this document. We also thank Jacques A. Vidrine for drawing attention to this issue.

This document was written by Jeffrey P. Lanza.

Other Information

CVE IDs:	CVE-2003-0026
CERT Advisory:	CA-2003-01 Severity Metric: