Lucene search

K
vmwareVMwareVMSA-2009-0014
HistoryOct 16, 2009 - 12:00 a.m.

VMware ESX patches for DHCP, Service Console kernel, and JRE resolve multiple security issues

2009-10-1600:00:00
www.vmware.com
58

0.972 High

EPSS

Percentile

99.8%

a. Service Console update for DHCP and third party library update for DHCP client.

DHCP is an Internet-standard protocol by which a computer can be
connected to a local network, ask to be given configuration
information, and receive from a server enough information to
configure itself as a member of that network.

A stack-based buffer overflow in the script_write_params method in
ISC DHCP dhclient allows remote DHCP servers to execute arbitrary
code via a crafted subnet-mask option.

The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-0692 to this issue.

An insecure temporary file use flaw was discovered in the DHCP
daemon’s init script (“/etc/init.d/dhcpd”). A local attacker could
use this flaw to overwrite an arbitrary file with the output of the
“dhcpd -t” command via a symbolic link attack, if a system
administrator executed the DHCP init script with the “configtest”,
“restart”, or “reload” option.

The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-1893 to this issue.

The following table lists what action remediates the vulnerability
in the Service Console (column 4) if a solution is available.