Format string vulnerability in the log functions in dhcpd for dhcp 2.x allows remote DNS servers to execute arbitrary code via certain DNS messages, a different vulnerability than CVE-2002-0702.

The ISC DHCP programs are vulnerable to several format string vulnerabilities which may allow a remote attacker to execute arbitrary code with the permissions of the DHCP programs, typically root for the DHCP server.

An updated dhcp package that fixes a string format issue is now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The dhcp package provides the ISC Dynamic Host Configuration Protocol (DHCP) server and relay agent, dhcpd. DHCP is a protocol that allows devices to get their own network configuration information from a server.

A bug was found in the way dhcpd logs error messages. A malicious DNS server could send a carefully crafted DNS reply and cause dhcpd to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0446 to this issue.

All users of dhcp should upgrade to this updated package, which contains a backported patch and is not vulnerable to this issue.

'infamous41md' noticed that the log functions in dhcp 2.x, which is still distributed in the stable Debian release, contained pass parameters to function that use format strings. One use seems to be exploitable in connection with a malicious DNS server.

The remote host is running a DHCP server. If it is ISC-DHCP, there might be several flaws in it that may allow an attacker to gain a root shell on this host.

ID	Name	Product	Family	Severity
19356	FreeBSD : isc-dhcpd -- format string vulnerabilities (ccd325d2-fa08-11d9-bc08-0001020eed82)	Nessus	FreeBSD Local Security Checks	critical
18018	RHEL 2.1 : dhcp (RHSA-2005:212)	Nessus	Red Hat Local Security Checks	critical
15682	Debian DSA-584-1 : dhcp - format string vulnerability	Nessus	Debian Local Security Checks	critical
1907	DHCP Server Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Generic	info

Detections

Analytics

CVE-2004-1006

critical

Tenable Plugins

critical

critical

critical

info