(Red Hat Issues Fix) OpenBSD dhcpd Buffer Overflow Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018848 |
|
SecurityTracker URL: http://securitytracker.com/id/1018848
|
|
CVE Reference:
CVE-2007-5365
(Links to External Site)
|
Date: Oct 23 2007
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in dhcpd on OpenBSD. A remote user on the local network can execute arbitrary code on the target system. Other operating systems may be affected.
A remote user on the local network can send specially crafted DHCP data to trigger a buffer overflow and execute arbitrary code on the target system. The code will run with the privileges of the target service.
A specially crafted maximum message size that is less than the minimum IP MTU can trigger the overflow in dhcpd(8).
dhcpd(8) is not enabled by default.
Nahuel Riva and Gerardo Richarte of Core Security Technologies reported this vulnerability.
|
Impact:
A remote user on the local network can execute arbitrary code on the target system.
|
Solution:
Red Hat has released a fix.
The Red Hat advisory is available at:
https://rhn.redhat.com/errata/RHSA-2007-0970.html
|
Vendor URL: openbsd.org/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 23 Oct 2007 08:57:23 -0400
Subject: [RHSA-2007:0970-01] Important: dhcp security update
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: dhcp security update
Advisory ID: RHSA-2007:0970-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0970.html
Issue date: 2007-10-23
Updated on: 2007-10-23
Product: Red Hat Enterprise Linux
CVE Names: CVE-2007-5365
- ---------------------------------------------------------------------
1. Summary:
An updated dhcp package that corrects a security flaw is now available for
Red Hat Enterprise Linux 2.1.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
3. Problem description:
The dhcp package provides the ISC Dynamic Host Configuration Protocol
(DHCP) server and relay agent, dhcpd. DHCP is a protocol that allows
devices to get their own network configuration information from a server.
A bug was found in the way dhcpd validates certain DHCP protocol options.
A malicious DHCP client could send a carefully crafted DHCP request and cause
dhcpd to crash or possibly execute arbitrary code. (CVE-2007-5365)
All users of dhcp should upgrade to this updated package, which contains a
backported patch that resolves this issue.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
327781 - CVE-2007-5365 dhcpd stack-based buffer overlow
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 :
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/dhcp-2.0pl5-11.src.rpm
bc3905c228b60bbc915df1b3b15d6f12 dhcp-2.0pl5-11.src.rpm
i386:
79e4f918da843b09ffa9d9ee6c09e89c dhcp-2.0pl5-11.i386.rpm
ia64:
c490264ff32b441938a6543185f22b43 dhcp-2.0pl5-11.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/dhcp-2.0pl5-11.src.rpm
bc3905c228b60bbc915df1b3b15d6f12 dhcp-2.0pl5-11.src.rpm
ia64:
c490264ff32b441938a6543185f22b43 dhcp-2.0pl5-11.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/dhcp-2.0pl5-11.src.rpm
bc3905c228b60bbc915df1b3b15d6f12 dhcp-2.0pl5-11.src.rpm
i386:
79e4f918da843b09ffa9d9ee6c09e89c dhcp-2.0pl5-11.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5365
http://www.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFHHe+MXlSAg2UNWIIRAtmvAKCbpRONtAP6FJxjAjaMelUfq7wLTACfcX0v
A0ePQKfXEgQyCpx9q4nLQ5k=
=c6wu
-----END PGP SIGNATURE-----
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
|
|
