LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: April 7th, 2014
Linux Advisory Watch: April 4th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: Subject: [Security Announce] [ MDVSA-2009:153 ] dhcp Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake A vulnerability has been found and corrected in ISC DHCP: Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before 3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528; allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a malformed DHCP packet with a large dhcp-max-message-size that triggers a stack-based buffer overflow, related to servers configured to send many DHCP options to clients (CVE-2007-0062). This update provides fixes for this vulnerability.
 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:153
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : dhcp
 Date    : July 17, 2009
 Affected: 2008.1, Corporate 3.0, Corporate 4.0,
           Multi Network Firewall 2.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in ISC DHCP:
 
 Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before
 3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build
 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455
 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and
 ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528;
 allows remote attackers to cause a denial of service (daemon crash)
 or execute arbitrary code via a malformed DHCP packet with a large
 dhcp-max-message-size that triggers a stack-based buffer overflow,
 related to servers configured to send many DHCP options to clients
 (CVE-2007-0062).
 
 This update provides fixes for this vulnerability.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0062
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.1:
 e990b4848d5946aba0cb30da2032eab9  2008.1/i586/dhcp-client-3.0.7-0.1mdv2008.1.i586.rpm
 528854b7ab0ff79a33239f704b4404c2  2008.1/i586/dhcp-common-3.0.7-0.1mdv2008.1.i586.rpm
 8151495369c79ec8f38d22fb6d7497dd  2008.1/i586/dhcp-devel-3.0.7-0.1mdv2008.1.i586.rpm
 886541fa55ffaacc37a53f339f524e42  2008.1/i586/dhcp-doc-3.0.7-0.1mdv2008.1.i586.rpm
 09dba31d422d4f888d38411b9d22ec68  2008.1/i586/dhcp-relay-3.0.7-0.1mdv2008.1.i586.rpm
 607f5c3a11eac14ba89345ce5ef8b47d  2008.1/i586/dhcp-server-3.0.7-0.1mdv2008.1.i586.rpm 
 a77a2457b18c1451351a76fdb7472c78  2008.1/SRPMS/dhcp-3.0.7-0.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 3d443dc667a0ba0dfb28655beb79a7a0  2008.1/x86_64/dhcp-client-3.0.7-0.1mdv2008.1.x86_64.rpm
 a3b416aca289a48f85b5de72a1f4ac24  2008.1/x86_64/dhcp-common-3.0.7-0.1mdv2008.1.x86_64.rpm
 71b324e15d4b58c4a5ab3aed3bbd0a99  2008.1/x86_64/dhcp-devel-3.0.7-0.1mdv2008.1.x86_64.rpm
 a9c7b5638c446b507b87c0ac5cb4c8f4  2008.1/x86_64/dhcp-doc-3.0.7-0.1mdv2008.1.x86_64.rpm
 8d8ef19b3ccbbc7525a600c1896575fa  2008.1/x86_64/dhcp-relay-3.0.7-0.1mdv2008.1.x86_64.rpm
 8266ddf83f89615eba128653992f1d53  2008.1/x86_64/dhcp-server-3.0.7-0.1mdv2008.1.x86_64.rpm 
 a77a2457b18c1451351a76fdb7472c78  2008.1/SRPMS/dhcp-3.0.7-0.1mdv2008.1.src.rpm

 Corporate 3.0:
 54de19999bbf4b39ab3a9189dd5fa5fa  corporate/3.0/i586/dhcp-client-3.0.7-0.1.C30mdk.i586.rpm
 7b678eb4757dfcb400bbc4097ad60b78  corporate/3.0/i586/dhcp-common-3.0.7-0.1.C30mdk.i586.rpm
 54b63fd21aa07368e2ffc56878bd58e8  corporate/3.0/i586/dhcp-devel-3.0.7-0.1.C30mdk.i586.rpm
 031fec5d8ea648f653235d0bcc215914  corporate/3.0/i586/dhcp-relay-3.0.7-0.1.C30mdk.i586.rpm
 fef3b9e4299b4a677a589b07d3bf6ac5  corporate/3.0/i586/dhcp-server-3.0.7-0.1.C30mdk.i586.rpm 
 72105849e3d42b6d83a65b310c05d6a6  corporate/3.0/SRPMS/dhcp-3.0.7-0.1.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 2b10597ec3d80e8cb38e5a1b6b3f5b01  corporate/3.0/x86_64/dhcp-client-3.0.7-0.1.C30mdk.x86_64.rpm
 81ff104ac3e7c3a8debb4f72a1dfafb4  corporate/3.0/x86_64/dhcp-common-3.0.7-0.1.C30mdk.x86_64.rpm
 14a42d70ed2f1a4e7f267b1479d7eadf  corporate/3.0/x86_64/dhcp-devel-3.0.7-0.1.C30mdk.x86_64.rpm
 dfc169a8914abff0e70a15febfc3dfae  corporate/3.0/x86_64/dhcp-relay-3.0.7-0.1.C30mdk.x86_64.rpm
 4165cd0129634cdf83d456b3151263fc  corporate/3.0/x86_64/dhcp-server-3.0.7-0.1.C30mdk.x86_64.rpm 
 72105849e3d42b6d83a65b310c05d6a6  corporate/3.0/SRPMS/dhcp-3.0.7-0.1.C30mdk.src.rpm

 Corporate 4.0:
 bc1ecfae06371e69e63fc8efc17f8e94  corporate/4.0/i586/dhcp-client-3.0.7-0.1.20060mlcs4.i586.rpm
 6550db5984ae72454cfa9ad5592374fe  corporate/4.0/i586/dhcp-common-3.0.7-0.1.20060mlcs4.i586.rpm
 f9ab642c59ec5852cf55fe0745df76c1  corporate/4.0/i586/dhcp-devel-3.0.7-0.1.20060mlcs4.i586.rpm
 3bf8441409e0f9af6969e28bce5ab306  corporate/4.0/i586/dhcp-relay-3.0.7-0.1.20060mlcs4.i586.rpm
 a8cfab133de36ba8ccd5aa0e43695e2b  corporate/4.0/i586/dhcp-server-3.0.7-0.1.20060mlcs4.i586.rpm 
 3fe6c892410037196e1d1b7e1e26d406  corporate/4.0/SRPMS/dhcp-3.0.7-0.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 1b9536b1c2b83aa3ccc1902e741326ae  corporate/4.0/x86_64/dhcp-client-3.0.7-0.1.20060mlcs4.x86_64.rpm
 d68e0b712210df499dcde1a03c046f56  corporate/4.0/x86_64/dhcp-common-3.0.7-0.1.20060mlcs4.x86_64.rpm
 71797753f8f4ca74598060e437012d59  corporate/4.0/x86_64/dhcp-devel-3.0.7-0.1.20060mlcs4.x86_64.rpm
 ec1ca4d3d07e5a73c8cdff3ff2ef8bc3  corporate/4.0/x86_64/dhcp-relay-3.0.7-0.1.20060mlcs4.x86_64.rpm
 7eaacfb7e6960f9cf28a7961d7c2cbfe  corporate/4.0/x86_64/dhcp-server-3.0.7-0.1.20060mlcs4.x86_64.rpm 
 3fe6c892410037196e1d1b7e1e26d406  corporate/4.0/SRPMS/dhcp-3.0.7-0.1.20060mlcs4.src.rpm

 Multi Network Firewall 2.0:
 c630bf4ca79dbd033df6088452026a61  mnf/2.0/i586/dhcp-client-3.0.7-0.1.C30mdk.i586.rpm
 8672951e8a2c4eb635565effd354c58d  mnf/2.0/i586/dhcp-common-3.0.7-0.1.C30mdk.i586.rpm
 3588da06614ebd385af28c9b0bb6f3ed  mnf/2.0/i586/dhcp-devel-3.0.7-0.1.C30mdk.i586.rpm
 ccf7eb57ade14a72f6ba74860bff7b8f  mnf/2.0/i586/dhcp-relay-3.0.7-0.1.C30mdk.i586.rpm
 e14d98b9232460d191330a3262c91f4b  mnf/2.0/i586/dhcp-server-3.0.7-0.1.C30mdk.i586.rpm 
 7387728a9235b4098fb7abd1c5583ca0  mnf/2.0/SRPMS/dhcp-3.0.7-0.1.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Canadians arrest a Heartbleed hacker
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.