CVE-2009-0692

2009-07-1400:00:00

ubuntu.com

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.076 Low

EPSS

Percentile

94.1%

JSON

Stack-based buffer overflow in the script_write_params method in
client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before
4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to
execute arbitrary code via a crafted subnet-mask option.

Notes

Author	Note
jdstrand	requires connecting to a malicious dhcp v4 server. Assigning high priority due to widespread use and frequency of roaming users connecting to untrusted dhcp servers CERT VU#410676 this is only a DoS on Intrepid and later due to FORTIFY_SOURCE and can be considered ‘low’. Jaunty also has an AppArmor profile that fully mitigates arbitrary code execution. dhcp v2 is not affected because it checks that lease -> options [DHO_SUBNET_MASK].len < sizeof lease -> address.iabuf. address.iabuf is the same size as netmask.iabuf. Furthermore, subnet_number() and broadcast_addr() (further below) properly check/use the length of netmask

Author

Note

jdstrand

requires connecting to a malicious dhcp v4 server. Assigning high priority due to widespread use and frequency of roaming users connecting to untrusted dhcp servers CERT VU#410676 this is only a DoS on Intrepid and later due to FORTIFY_SOURCE and can be considered ‘low’. Jaunty also has an AppArmor profile that fully mitigates arbitrary code execution. dhcp v2 is not affected because it checks that lease -> options [DHO_SUBNET_MASK].len < sizeof lease -> address.iabuf. address.iabuf is the same size as netmask.iabuf. Furthermore, subnet_number() and broadcast_addr() (further below) properly check/use the length of netmask

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchdhcp3< 3.0.3-6ubuntu7.1UNKNOWN
ubuntu8.04noarchdhcp3< 3.0.6.dfsg-1ubuntu9.1UNKNOWN
ubuntu8.10noarchdhcp3< 3.1.1-1ubuntu2.2UNKNOWN
ubuntu9.04noarchdhcp3< 3.1.1-5ubuntu8.2UNKNOWN
ubuntu9.10noarchdhcp3< 3.1.2-1ubuntu7.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	dhcp3	< 3.0.3-6ubuntu7.1	UNKNOWN
ubuntu	8.04	noarch	dhcp3	< 3.0.6.dfsg-1ubuntu9.1	UNKNOWN
ubuntu	8.10	noarch	dhcp3	< 3.1.1-1ubuntu2.2	UNKNOWN
ubuntu	9.04	noarch	dhcp3	< 3.1.1-5ubuntu8.2	UNKNOWN
ubuntu	9.10	noarch	dhcp3	< 3.1.2-1ubuntu7.1	UNKNOWN