CVE-2006-3122

The supersedelease function in memory.c in ISC DHCP dhcpd server 2.0pl5 allows remote attackers to cause a denial of service application crash via a DHCPDISCOVER packet with a 32 byte client-identifier, which causes the packet to be interpreted as a corrupt uid and causes the server to exit with...

ISC DHCP Server supersede_lease() Function DHCPDISCOVER Packet DoS

The ISC DHCP server running on the remote host is affected by a denial of service vulnerability in the supersedelease function within file memory.c due to improper handling of DHCPDISCOVER packets that have a client-identifier option that is exactly 32 bytes long. An unauthenticated, remote...

ISC DHCP contains a format string vulnerabilty in errwarn.c

Overview The Internet Systems Consortium ISC Dynamic Host Configuration Protocol DHCP application contains a format string vulnerability in errwarn.c that could allow an attacker to execute arbitrary code. Description As described in RFC 2131, "The Dynamic Host Configuration Protocol DHCP provide...

isc-dhcpd -- format string vulnerabilities

The ISC DHCP programs are vulnerable to several format string vulnerabilities which may allow a remote attacker to execute arbitrary code with the permissions of the DHCP programs, typically root for the DHCP server...

ISC DHCP overflows

Hi, for those interested to reproduce the recent DOS attacks against ISC DHCPD 3.0.1 rc12 and rc13 as described in: http://www.kb.cert.org/vuls/id/317350 , i'm forwarding the first email i sent to ISC describing several stack based buffer overflows occuring during the creation of log messages and...

ISC DHCP buffer overflow

Buffer overflow on oversized hostname in DHCP query, if hostname is splitted to few attributes...

CVE-2004-0461

ISC DHCPD 3.0.1rc12/rc13 contains two buffer overflow risks: when vsnprintf support is absent, header files map vsnprintf to the unsafe vsprintf, enabling possible DoS (server crash) and potentially arbitrary code execution. The issue affects the DHCP server component in ISC DHCP 3.0.1rc12/rc13 a...

CVE-2004-0460

ISC DHCP 3.0.1rc12 and 3.0.1rc13 are affected by a buffer overflow in the DHCPD logging path when processing multiple hostname options in DISCOVER/OFFER/REQUEST/ACK/NAK, potentially enabling remote code execution and denial of service. The issue stems from long hostname options being concatenated...

US-CERT Technical Cyber Security Alert TA04-174A -- Multiple Vulnerabilities in ISC DHCP 3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Technical Cyber Security Alert TA04-174A Multiple Vulnerabilities in ISC DHCP 3 Original release date: June 22, 2004 Last revised: -- Source: US-CERT Systems Affected ISC DHCP versions 3.0.1rc12 and 3.0.1rc13 Overview Two vulnerabilities in the ISC DH...

ISC DHCP contains C Includes that define vsnprintf() to vsprintf() creating potential buffer overflow conditions

Overview The Internet Systems Consortium's ISC Dynamic Host Configuration Protocol DHCP 3 application contains a vulnerability that introduces several potential buffer overflow conditions. Exploitation of this vulnerability can cause a denial-of-service condition to the DHCP Daemon DHCPD and may...

ISC DHCP contains a stack buffer overflow vulnerability in handling log lines containing ASCII characters only

Overview The Internet Systems Consortium's ISC Dynamic Host Configuration Protocol DHCP 3 application contains a buffer overflow vulnerability. Exploitation of this vulnerability can cause a denial of service condition to the DHCP Daemon DHCPD and may permit a remote attacker to execute arbitrary...

DSA-231 dhcp3 - stack overflows

Bulletin has no description...

CVE-2002-0702

Format string vulnerabilities in the logging routines for dynamic DNS code print.c of ISC DHCP daemon DHCPD 3 to 3.0.1rc8, with the NSUPDATE option enabled, allow remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response...

CVE-2002-0702

ISC DHCPD (dhcpd) versions 3 through 3.0.1rc8, with NSUPDATE enabled, contain a format string vulnerability in the logging code (print.c) that can allow remote DNS servers to execute arbitrary code via crafted DNS responses. The vulnerability is in the dynamic DNS update path and logging of updat...

CVE-2002-0702

Format string vulnerabilities in the logging routines for dynamic DNS code print.c of ISC DHCP daemon DHCPD 3 to 3.0.1rc8, with the NSUPDATE option enabled, allow remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response...

Format string bug in ISC dhcpd

Format string on syslog call in NSUPDATE functionality...

CVE-1999-0808

Multiple buffer overflows in ISC DHCP Distribution server dhcpd 1.0 and 2.0 allow a remote attacker to cause a denial of service crash and possibly execute arbitrary commands via long options...

CVE-1999-0808

CVE-1999-0808 highlights multiple buffer overflows in ISC DHCP Distribution server (dhcpd) versions 1.0 and 2.0. The root cause, as documented, is unsafe handling of long options, which can be exploited by a remote attacker to cause a crash and potentially execute arbitrary commands. Affected com...

CVE-2000-0585

ISC DHCP client program dhclient allows remote attackers to execute arbitrary commands via shell metacharacters...

isc-dhcpd.exploit.txt

Somebody at OpenBSD discovered a possible root exploit in the ISC DHCP client. I can confirm that as of 6:23am on June 23rd after several hours of hacking around the sources I had the following dhcpd config running on my own machine's private network for testing: shared-network LOCAL-NET option...