CVE-2007-5365 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute....
HighCVSS 7.2
EPSS 80.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian linux | = 3.1 | No fix listed |
| debian linux | = 4.0 | No fix listed |
| OpenBSD | = 4.0 | No fix listed |
| OpenBSD | = 4.1 | No fix listed |
| OpenBSD | = 4.2 | No fix listed |
| redhat enterprise linux | = 2.1 | No fix listed |
| redhat linux advanced workstation | = 2.1 | No fix listed |
| sun opensolaris | = snv_01 | No fix listed |
| sun opensolaris | = snv_02 | No fix listed |
| sun opensolaris | = snv_03 | No fix listed |
| sun opensolaris | = snv_04 | No fix listed |
| sun opensolaris | = snv_05 | No fix listed |
| sun opensolaris | = snv_06 | No fix listed |
| sun opensolaris | = snv_07 | No fix listed |
| sun opensolaris | = snv_08 | No fix listed |
| sun opensolaris | = snv_09 | No fix listed |
| sun opensolaris | = snv_10 | No fix listed |
| sun opensolaris | = snv_11 | No fix listed |
| sun opensolaris | = snv_12 | No fix listed |
| sun opensolaris | = snv_13 | No fix listed |
| sun opensolaris | = snv_14 | No fix listed |
| sun opensolaris | = snv_15 | No fix listed |
| sun opensolaris | = snv_16 | No fix listed |
| sun opensolaris | = snv_17 | No fix listed |
| sun opensolaris | = snv_18 | No fix listed |
Show 91 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sun opensolaris | = snv_19 | No fix listed |
| sun opensolaris | = snv_20 | No fix listed |
| sun opensolaris | = snv_21 | No fix listed |
| sun opensolaris | = snv_22 | No fix listed |
| sun opensolaris | = snv_23 | No fix listed |
| sun opensolaris | = snv_24 | No fix listed |
| sun opensolaris | = snv_25 | No fix listed |
| sun opensolaris | = snv_26 | No fix listed |
| sun opensolaris | = snv_27 | No fix listed |
| sun opensolaris | = snv_28 | No fix listed |
| sun opensolaris | = snv_29 | No fix listed |
| sun opensolaris | = snv_30 | No fix listed |
| sun opensolaris | = snv_31 | No fix listed |
| sun opensolaris | = snv_32 | No fix listed |
| sun opensolaris | = snv_33 | No fix listed |
| sun opensolaris | = snv_34 | No fix listed |
| sun opensolaris | = snv_35 | No fix listed |
| sun opensolaris | = snv_36 | No fix listed |
| sun opensolaris | = snv_37 | No fix listed |
| sun opensolaris | = snv_38 | No fix listed |
| sun opensolaris | = snv_39 | No fix listed |
| sun opensolaris | = snv_40 | No fix listed |
| sun opensolaris | = snv_41 | No fix listed |
| sun opensolaris | = snv_42 | No fix listed |
| sun opensolaris | = snv_43 | No fix listed |
| sun opensolaris | = snv_44 | No fix listed |
| sun opensolaris | = snv_45 | No fix listed |
| sun opensolaris | = snv_46 | No fix listed |
| sun opensolaris | = snv_47 | No fix listed |
| sun opensolaris | = snv_48 | No fix listed |
| sun opensolaris | = snv_49 | No fix listed |
| sun opensolaris | = snv_50 | No fix listed |
| sun opensolaris | = snv_51 | No fix listed |
| sun opensolaris | = snv_52 | No fix listed |
| sun opensolaris | = snv_53 | No fix listed |
| sun opensolaris | = snv_54 | No fix listed |
| sun opensolaris | = snv_55 | No fix listed |
| sun opensolaris | = snv_56 | No fix listed |
| sun opensolaris | = snv_57 | No fix listed |
| sun opensolaris | = snv_58 | No fix listed |
| sun opensolaris | = snv_59 | No fix listed |
| sun opensolaris | = snv_60 | No fix listed |
| sun opensolaris | = snv_61 | No fix listed |
| sun opensolaris | = snv_62 | No fix listed |
| sun opensolaris | = snv_63 | No fix listed |
| sun opensolaris | = snv_64 | No fix listed |
| sun opensolaris | = snv_65 | No fix listed |
| sun opensolaris | = snv_66 | No fix listed |
| sun opensolaris | = snv_67 | No fix listed |
| sun opensolaris | = snv_68 | No fix listed |
| sun opensolaris | = snv_69 | No fix listed |
| sun opensolaris | = snv_70 | No fix listed |
| sun opensolaris | = snv_71 | No fix listed |
| sun opensolaris | = snv_72 | No fix listed |
| sun opensolaris | = snv_73 | No fix listed |
| sun opensolaris | = snv_74 | No fix listed |
| sun opensolaris | = snv_75 | No fix listed |
| sun opensolaris | = snv_76 | No fix listed |
| sun opensolaris | = snv_77 | No fix listed |
| sun opensolaris | = snv_78 | No fix listed |
| sun opensolaris | = snv_79 | No fix listed |
| sun opensolaris | = snv_80 | No fix listed |
| sun opensolaris | = snv_81 | No fix listed |
| sun opensolaris | = snv_82 | No fix listed |
| sun opensolaris | = snv_83 | No fix listed |
| sun opensolaris | = snv_84 | No fix listed |
| sun opensolaris | = snv_85 | No fix listed |
| sun opensolaris | = snv_86 | No fix listed |
| sun opensolaris | = snv_87 | No fix listed |
| sun opensolaris | = snv_88 | No fix listed |
| sun opensolaris | = snv_89 | No fix listed |
| sun opensolaris | = snv_90 | No fix listed |
| sun opensolaris | = snv_91 | No fix listed |
| sun opensolaris | = snv_92 | No fix listed |
| sun opensolaris | = snv_93 | No fix listed |
| sun opensolaris | = snv_94 | No fix listed |
| sun opensolaris | = snv_95 | No fix listed |
| sun opensolaris | = snv_96 | No fix listed |
| sun opensolaris | = snv_97 | No fix listed |
| sun opensolaris | = snv_98 | No fix listed |
| sun opensolaris | = snv_99 | No fix listed |
| sun opensolaris | = snv_100 | No fix listed |
| sun opensolaris | = snv_101 | No fix listed |
| sun opensolaris | = snv_102 | No fix listed |
| sun solaris | = 8.0 | No fix listed |
| sun solaris | = 9.0 | No fix listed |
| sun solaris | = 10.0 | No fix listed |
| ubuntu linux | = 6.06-_nil_ | No fix listed |
| ubuntu linux | = 6.10 | No fix listed |
| ubuntu linux | = 7.04 | No fix listed |
| ubuntu linux | = 7.10 | No fix listed |
References
- bugs.debian.org
- 27160 third-party-advisory vendor-advisory
- 27273 third-party-advisory vendor-advisory
- 27338 third-party-advisory vendor-advisory
- 27350 third-party-advisory vendor-advisory
- 32668 third-party-advisory vendor-advisory
- 1021157 vdb-entry
- sunsolve.sun.com
- 243806 vendor-advisory
- www.coresecurity.com
- DSA-1388 vendor-advisory
- www.openbsd.org patch
- [4.0] 20071008 016: SECURITY FIX: October 8, 2007 patch vendor-advisory
- [4.1] 20071008 010: SECURITY FIX: October 8, 2007 patch vendor-advisory
- [4.2] 20071008 001: SECURITY FIX: October 8, 2007 patch vendor-advisory
- RHSA-2007:0970 vendor-advisory
- 20071011 CORE-2007-0928: Stack-based buffer overflow vulnerability in OpenBSDâ??s DHCP server mailing-list
- 20071102 DoS Exploit for DHCPd bug (Bugtraq ID 25984 ; CVE-2007-5365) mailing-list
- 25984 patch vdb-entry
- 32213 vdb-entry
- 1018794 vdb-entry
- USN-531-1 vendor-advisory
- USN-531-2 vendor-advisory
- ADV-2008-3088 vdb-entry vendor-advisory
- openbsd-dhcp-bo(37045) vdb-entry
- oval:org.mitre.oval:def:5817 signature vdb-entry
- 4601 exploit