CVSS: 6.5EPSS: 0%CPEs: 35EXPL: 0CVE-2022-2929 – DHCP memory leak
https://notcve.org/view.php?id=CVE-2022-2929
In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory. En ISC DHCP versiones 1.0 anteriores a 4.4.3, ISC DHCP versiones 4.1-ESV-R1 anteriores a 4.1-ESV-R16-P1, un sistema con acceso a un servidor DHCP, enviando paquetes DHCP diseñados para incluir etiquetas fqdn de más de 63 bytes, podría llegar a causar a el servidor quedarse sin memoria A vulnerability was found in the DHCP server where the "fqdn_universe_decode()" function allocates buffer space for the contents of option 81 (fqdn) data received in a DHCP packet. The maximum length of a DNS "label" is 63 bytes. The function tests the length byte of each label contained in the "fqdn"; if it finds a label whose length byte value is larger than 63, it returns without dereferencing the buffer space. This issue causes a memory leak. • https://kb.isc.org/docs/cve-2022-2929 https://lists.debian.org/debian-lts-announce/2022/10/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SARIK7KZ7MGQIWDRWZFAOSQSPXY4GOU https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQXYCIWUDILRCNBAIMVFCSGXBRKEPB4K https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6IBFH4MRRNJQVWEKILQ6I6CXWW766FX https://security.gentoo.org/glsa/202305-22 https:/&#x • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.1EPSS: 0%CPEs: 102EXPL: 0CVE-2011-4868
https://notcve.org/view.php?id=CVE-2011-4868
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update. La funcionalidad de registro en el dhcpd de ISC DHCP anterior a v4.2.3-P2, cuando se utiliza DNS dinámico (DDNS) y direcciones IPv6, no maneja correctamente la estructura de arrendamiento (lease structure) DHCPv6, permitiendo a atacantes remotos provocar una denegación de servicio (puntero a NULL y el caída del servicio) mediante paquetes especialmente elaborados en relación con una actualización lease-status. • http://security.gentoo.org/glsa/glsa-201301-06.xml https://deepthought.isc.org/article/AA-00595 https://kb.isc.org/article/AA-00705 https://www.isc.org/software/dhcp/advisories/cve-2011-4868 • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 7%CPEs: 5EXPL: 1CVE-2009-0692 – ISC DHCP dhclient < 3.1.2p1 - Remote Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2009-0692
Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option. Desbordamiento de búfer basado en pila en el método script_write_params en client/dhclient.c en ISC DHCP dhclient v4.1 anteriores a v4.1.0p1, v4.0 anteriores a v4.0.1p1, v3.1 anteriores a v3.1.2p1, v3.0, y v2.0 permite a servidores DHCP remotos ejecutar código arbitrario a través de una opción manipulada subnet-mask. • https://www.exploit-db.com/exploits/9265 http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-010.txt.asc http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083 http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00003.html http://secunia.com/advisories/35785 http://secunia.com/advisories/35829 http://secunia.com/advisories/35830 http://secunia.com/advisories/35831 http://secunia.com/advisories/35832 http://secunia.com/advisories/35841 http • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 10.0EPSS: 2%CPEs: 2EXPL: 0CVE-2000-0585
https://notcve.org/view.php?id=CVE-2000-0585
ISC DHCP client program dhclient allows remote attackers to execute arbitrary commands via shell metacharacters. • ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:34.dhclient.asc ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/advisories/NetBSD-SA2000-008.txt.asc http://archives.neohapsis.com/archives/bugtraq/2000-06/0247.html http://archives.neohapsis.com/archives/bugtraq/2000-07/0014.html http://www.debian.org/security/2000/20000628 http://www.novell.com/linux/security/advisories/suse_security_announce_56.html http://www.securityfocus.com/bid/1388 https://exchange.xforce.ibmcloud& •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-1999-0808
https://notcve.org/view.php?id=CVE-1999-0808
Multiple buffer overflows in ISC DHCP Distribution server (dhcpd) 1.0 and 2.0 allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary commands via long options. • ftp://ftp.isc.org/isc/dhcp/dhcp-1.0-history/dhcp-1.0.0-1.0pl1.diff.gz http://ciac.llnl.gov/ciac/bulletins/i-053.shtml http://marc.info/?l=bugtraq&m=90221101925960&w=2 •