Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - ISC DHCP dhclient
  - Integrated Services Digital Network (ISDN) subsystem
  - Java Runtime Environment (JRE)
  - Java SE Development Kit (JDK)
  - Java SE Web Start
  - Linux kernel
  - Linux kernel 32-bit and 64-bit emulation
  - Linux kernel Simple Internet Transition INET6
  - Linux kernel tty
  - Linux kernel virtual file system (VFS)
  - Red Hat dhcpd init script for DHCP
  - SBNI WAN driver

From Red Hat Security Advisory 2009:1154 :

Updated dhcp packages that fix two security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.

The Mandriva Linux Engineering Team discovered a stack-based buffer overflow flaw in the ISC DHCP client. If the DHCP client were to receive a malicious DHCP response, it could crash or execute arbitrary code with the permissions of the client (root). (CVE-2009-0692)

An insecure temporary file use flaw was discovered in the DHCP daemon's init script ('/etc/init.d/dhcpd'). A local attacker could use this flaw to overwrite an arbitrary file with the output of the 'dhcpd
-t' command via a symbolic link attack, if a system administrator executed the DHCP init script with the 'configtest', 'restart', or 'reload' option. (CVE-2009-1893)

Users of DHCP should upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2009:1136 :

Updated dhcp packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 4.7 Extended Update Support.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.

The Mandriva Linux Engineering Team discovered a stack-based buffer overflow flaw in the ISC DHCP client. If the DHCP client were to receive a malicious DHCP response, it could crash or execute arbitrary code with the permissions of the client (root). (CVE-2009-0692)

Users of DHCP should upgrade to these updated packages, which contain a backported patch to correct this issue.

The Mandriva Linux Engineering Team discovered a stack-based buffer overflow flaw in the ISC DHCP client. If the DHCP client were to receive a malicious DHCP response, it could crash or execute arbitrary code with the permissions of the client (root). (CVE-2009-0692)

An insecure temporary file use flaw was discovered in the DHCP daemon's init script ('/etc/init.d/dhcpd'). A local attacker could use this flaw to overwrite an arbitrary file with the output of the 'dhcpd
-t' command via a symbolic link attack, if a system administrator executed the DHCP init script with the 'configtest', 'restart', or 'reload' option. (CVE-2009-1893)

Several remote vulnerabilities have been discovered in ISC's DHCP implementation :

  - CVE-2009-0692     It was discovered that dhclient does not properly handle     overlong subnet mask options, leading to a stack-based     buffer overflow and possible arbitrary code execution.

  - CVE-2009-1892     Christoph Biedl discovered that the DHCP server may     terminate when receiving certain well-formed DHCP     requests, provided that the server configuration mixes     host definitions using 'dhcp-client-identifier' and     'hardware ethernet'. This vulnerability only affects the     lenny versions of dhcp3-server and dhcp3-server-ldap.

USN-803-1 fixed a vulnerability in Dhcp. Due to an error, the patch to fix the vulnerability was not properly applied on Ubuntu 8.10 and higher. Even with the patch improperly applied, the default compiler options reduced the vulnerability to a denial of service.
Additionally, in Ubuntu 9.04 and higher, users were also protected by the AppArmor dhclient3 profile. This update fixes the problem.

It was discovered that the DHCP client as included in dhcp3 did not verify the length of certain option fields when processing a response from an IPv4 dhcp server. If a user running Ubuntu 6.06 LTS or 8.04 LTS connected to a malicious dhcp server, a remote attacker could cause a denial of service or execute arbitrary code as the user invoking the program, typically the 'dhcp' user. For users running Ubuntu 8.10 or 9.04, a remote attacker should only be able to cause a denial of service in the DHCP client. In Ubuntu 9.04, attackers would also be isolated by the AppArmor dhclient3 profile.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in ISC DHCP :

Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before 3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528; allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a malformed DHCP packet with a large dhcp-max-message-size that triggers a stack-based buffer overflow, related to servers configured to send many DHCP options to clients (CVE-2007-0062).

Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option (CVE-2009-0692).

ISC DHCP Server is vulnerable to a denial of service, caused by the improper handling of DHCP requests. If the host definitions are mixed using dhcp-client-identifier and hardware ethernet, a remote attacker could send specially crafted DHCP requests to cause the server to stop responding (CVE-2009-1892).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides fixes for this vulnerability.

Do not require policycoreutils when installing dhcp or dhclient packages. If you have the package installed, the /sbin/restorecon program will be used by dhclient-script and the dhcpd init script.
This update to the dhcp package includes fixes for CVE-2009-0692 and CVE-2009-1892. More information on these issues are available here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0692 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1892 Note:
CVE-2009-0692 had no security consequences on Fedora, thanks to the use of FORTIFY_SOURCE

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

a. Service Console update for DHCP and third-party library update    for DHCP client.

   DHCP is an Internet-standard protocol by which a computer can be    connected to a local network, ask to be given configuration    information, and receive from a server enough information to    configure itself as a member of that network.

   A stack-based buffer overflow in the script_write_params method in    ISC DHCP dhclient allows remote DHCP servers to execute arbitrary    code via a crafted subnet-mask option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0692 to this issue.

   An insecure temporary file use flaw was discovered in the DHCP    daemon's init script ('/etc/init.d/dhcpd'). A local attacker could    use this flaw to overwrite an arbitrary file with the output of the    'dhcpd -t' command via a symbolic link attack, if a system    administrator executed the DHCP init script with the 'configtest',    'restart', or 'reload' option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1893 to this issue.

b. Updated Service Console package kernel

   Service Console package kernel update to version    kernel-2.4.21-58.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-4210, CVE-2008-3275, CVE-2008-0598,    CVE-2008-2136, CVE-2008-2812, CVE-2007-6063, CVE-2008-3525 to the    security issues fixed in kernel-2.4.21-58.EL

c. JRE Security Update

   JRE update to version 1.5.0_18, which addresses multiple security    issues that existed in earlier releases of JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_17: CVE-2008-2086, CVE-2008-5347, CVE-2008-5348,    CVE-2008-5349, CVE-2008-5350, CVE-2008-5351, CVE-2008-5352,    CVE-2008-5353, CVE-2008-5354, CVE-2008-5356, CVE-2008-5357,    CVE-2008-5358, CVE-2008-5359, CVE-2008-5360, CVE-2008-5339,    CVE-2008-5342, CVE-2008-5344, CVE-2008-5345, CVE-2008-5346,    CVE-2008-5340, CVE-2008-5341, CVE-2008-5343, and CVE-2008-5355.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,    CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,    CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,    CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

The DHCP client (dhclient) could be crashed by a malicious DHCP server sending a overlong subnet field. (CVE-2009-0692)

In some circumstances code execution might be possible, but might is likely caught by the buffer overflow checking of the FORTIFY_SOURCE extension.

The DHCP client (dhclient) could be crashed by a malicious DHCP server sending a overlong subnet field. (CVE-2009-0692)

In some circumstances code execution might be possible, but might be caught by the buffer overflow checking in newer distributions. (SLES 10 and 11).

The DHCP client (dhclient) could be crashed by a malicious DHCP server sending an overlong subnet field. Under some circumstances remote code execution might be possible by exploiting the resulting buffer overflow. This issue has been tracked by CVE-2009-0692.

This update to the dhcp package includes fixes for CVE-2009-0692 and CVE-2009-1892. More information on these issues are available here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0692 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1892 Note:
CVE-2009-0692 had no security consequences on Fedora, thanks to the use of FORTIFY_SOURCE

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in ISC DHCP :

Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option (CVE-2009-0692).

This update provides fixes for this vulnerability.

US-CERT reports :

The ISC DHCP dhclient application contains a stack-based buffer overflow, which may allow a remote, unauthenticated attacker to execute arbitrary code with root privileges.

Updated dhcp packages that fix two security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.

The Mandriva Linux Engineering Team discovered a stack-based buffer overflow flaw in the ISC DHCP client. If the DHCP client were to receive a malicious DHCP response, it could crash or execute arbitrary code with the permissions of the client (root). (CVE-2009-0692)

An insecure temporary file use flaw was discovered in the DHCP daemon's init script ('/etc/init.d/dhcpd'). A local attacker could use this flaw to overwrite an arbitrary file with the output of the 'dhcpd
-t' command via a symbolic link attack, if a system administrator executed the DHCP init script with the 'configtest', 'restart', or 'reload' option. (CVE-2009-1893)

Users of DHCP should upgrade to these updated packages, which contain backported patches to correct these issues.

It was discovered that the DHCP client as included in dhcp3 did not verify the length of certain option fields when processing a response from an IPv4 dhcp server. If a user running Ubuntu 6.06 LTS or 8.04 LTS connected to a malicious dhcp server, a remote attacker could cause a denial of service or execute arbitrary code as the user invoking the program, typically the 'dhcp' user. For users running Ubuntu 8.10 or 9.04, a remote attacker should only be able to cause a denial of service in the DHCP client. In Ubuntu 9.04, attackers would also be isolated by the AppArmor dhclient3 profile.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated dhcp packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 4.7 Extended Update Support.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.

The Mandriva Linux Engineering Team discovered a stack-based buffer overflow flaw in the ISC DHCP client. If the DHCP client were to receive a malicious DHCP response, it could crash or execute arbitrary code with the permissions of the client (root). (CVE-2009-0692)

Users of DHCP should upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200907-12 (ISC DHCP: dhcpclient Remote execution of arbitrary code)

    The Mandriva Linux Engineering Team has reported a stack-based buffer     overflow in the subnet-mask handling of dhclient.
  Impact :

    A remote attacker might set up a rogue DHCP server in a victim's local     network, possibly leading to the execution of arbitrary code with root     privileges.
  Workaround :

    There is no known workaround at this time.

New dhcp packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix a security issue with dhclient. Note that dhclient is not the default DHCP client in Slackware's networking scripts, dhcpcd is. However, if you use dhclient on a network where someone could deploy a hostile DHCP server, you should upgrade to the new package.

ID	Name	Product	Family	Severity
89116	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0014) (remote check)	Nessus	Misc.	critical
67891	Oracle Linux 3 : dhcp (ELSA-2009-1154)	Nessus	Oracle Linux Local Security Checks	critical
67886	Oracle Linux 4 : dhcp (ELSA-2009-1136)	Nessus	Oracle Linux Local Security Checks	critical
60615	Scientific Linux Security Update : dhcp on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
44698	Debian DSA-1833-1 : dhcp3 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
44326	Ubuntu 8.10 / 9.04 / 9.10 : dhcp3 vulnerability (USN-803-2)	Nessus	Ubuntu Local Security Checks	critical
42998	Mandriva Linux Security Advisory : dhcp (MDVSA-2009:312)	Nessus	Mandriva Local Security Checks	critical
42454	Fedora 11 : dhcp-4.1.0p1-4.fc11 (2009-9075)	Nessus	Fedora Local Security Checks	critical
42179	VMSA-2009-0014 : VMware ESX patches for DHCP, Service Console kernel, and JRE resolve multiple security issues	Nessus	VMware ESX Local Security Checks	high
41996	openSUSE 10 Security Update : dhcp (dhcp-6336)	Nessus	SuSE Local Security Checks	critical
41502	SuSE 10 Security Update : dhclient (ZYPP Patch Number 6335)	Nessus	SuSE Local Security Checks	critical
41383	SuSE 11 Security Update : dhcp-client (SAT Patch Number 1041)	Nessus	SuSE Local Security Checks	critical
41310	SuSE9 Security Update : dhcp-client (YOU Patch Number 12447)	Nessus	SuSE Local Security Checks	critical
40774	Fedora 10 : dhcp-4.0.0-37.fc10 (2009-8344)	Nessus	Fedora Local Security Checks	critical
40212	openSUSE Security Update : dhcp (dhcp-1067)	Nessus	SuSE Local Security Checks	critical
39950	openSUSE Security Update : dhcp (dhcp-1067)	Nessus	SuSE Local Security Checks	critical
39804	Mandriva Linux Security Advisory : dhcp (MDVSA-2009:151)	Nessus	Mandriva Local Security Checks	critical
39802	FreeBSD : isc-dhcp-client -- Stack overflow vulnerability (c444c8b7-7169-11de-9ab7-000c29a67389)	Nessus	FreeBSD Local Security Checks	critical
39801	CentOS 3 : dhcp (CESA-2009:1154)	Nessus	CentOS Local Security Checks	critical
39800	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : dhcp3 vulnerability (USN-803-1)	Nessus	Ubuntu Local Security Checks	critical
39799	RHEL 3 : dhcp (RHSA-2009:1154)	Nessus	Red Hat Local Security Checks	critical
39798	RHEL 4 : dhcp (RHSA-2009:1136)	Nessus	Red Hat Local Security Checks	critical
39797	GLSA-200907-12 : ISC DHCP: dhcpclient Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
39796	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 8.1 / 9.0 / 9.1 / current : dhcp (SSA:2009-195-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2009-0692

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical