Vulnerabilities > CVE-2003-0026 - Remote Buffer Overflow vulnerability in ISC DHCPD NSUPDATE MiniRes Library
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Multiple stack-based buffer overflows in the error handling routines of the minires library, as used in the NSUPDATE capability for ISC DHCPD 3.0 through 3.0.1RC10, allow remote attackers to execute arbitrary code via a DHCP message containing a long hostname.
Nessus
NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2003-007.NASL description Several potential vulnerabilities were detected by the ISC (Internet Software Consortium) in their dhcp server software. The vulnerabilities affect the minires library and may be exploitable as stack buffer overflows, which could lead to remote code execution. All Mandrake Linux users are encouraged to upgrade; only Mandrake Linux 8.0 came with dhcp 2.x and is not vulnerable. last seen 2020-06-01 modified 2020-06-02 plugin id 13992 published 2004-07-31 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/13992 title Mandrake Linux Security Advisory : dhcp (MDKSA-2003:007) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-231.NASL description The Internet Software Consortium discovered several vulnerabilities during an audit of the ISC DHCP Daemon. The vulnerabilities exist in error handling routines within the minires library and may be exploitable as stack overflows. This could allow a remote attacker to execute arbitrary code under the user id the dhcpd runs under, usually root. Other DHCP servers than dhcp3 doesn last seen 2020-06-01 modified 2020-06-02 plugin id 15068 published 2004-09-29 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/15068 title Debian DSA-231-1 : dhcp3 - stack overflows
Redhat
| advisories |
|
References
- http://archives.neohapsis.com/archives/bugtraq/2003-01/0250.html
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000562
- http://www.cert.org/advisories/CA-2003-01.html
- http://www.ciac.org/ciac/bulletins/n-031.shtml
- http://www.debian.org/security/2003/dsa-231
- http://www.kb.cert.org/vuls/id/284857
- http://www.mandriva.com/security/advisories?name=MDKSA-2003:007
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.002.html
- http://www.redhat.com/support/errata/RHSA-2003-011.html
- http://www.securityfocus.com/bid/6627
- http://www.securitytracker.com/id?1005924
- http://www.suse.com/de/security/2003_006_dhcp.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/11073