CVSS: 7.9EPSS: 96%CPEs: 67EXPL: 1CVE-2011-0997 – dhclient: insufficient sanitization of certain DHCP response values
https://notcve.org/view.php?id=CVE-2011-0997
dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script. dhclient en ISC DHCP 3.0.x hasta la versión 4.2.x en versiones anteriores a 4.2.1-P1, 3.1-ESV en versiones anteriores a 3.1-ESV-R1 y 4.1-ESV en versiones anteriores a 4.1-ESV-R2 permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres shell en un nombre de anfitrión obtenido de un mensaje DHCP, como es demostrado por un nombre de anfitrión dado por dhclient-script. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057888.html http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058279.html http://marc.info/?l=bugtraq&m=133226187115472&w=2 http://secunia.com/advisories/44037 http://secunia.com/advisories/44048 http://secunia.com/advisories/44089 http://secunia.com/advisories/44090 http://secunia.com/advisories/44103 http://secunia.com/advisories/44127&# • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.1EPSS: 9%CPEs: 9EXPL: 0CVE-2011-0414
https://notcve.org/view.php?id=CVE-2011-0414
ISC BIND 9.7.1 through 9.7.2-P3, when configured as an authoritative server, allows remote attackers to cause a denial of service (deadlock and daemon hang) by sending a query at the time of (1) an IXFR transfer or (2) a DDNS update. En ISC BIND versión 9.7.1 hasta 9.7.2-P3, cuando está configurado como un servidor autorizado, permite a los atacantes remotos generar una denegación de servicio (punto muerto y suspensión de demonio) al enviar una consulta en el momento de (1) una transferencia IXFR o ( 2) una actualización de DDNS. • http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://secunia.com/advisories/43439 http://secunia.com/advisories/43443 http://www.debian.org/security/2011/dsa-2208 http://www.isc.org/software/bind/advisories/cve-2011-0414 http://www.kb.cert.org/vuls/id/449980 http://www.kb.cert.org/vuls/id/559980 http://www.securitytracker.com/id?1025110 http://www.ubuntu.com/usn/USN-1070-1 http://www.vupen.com/english/advisories/2011/0466 http:& • CWE-399: Resource Management Errors •
CVSS: 7.8EPSS: 1%CPEs: 29EXPL: 0CVE-2011-0413 – dhcp: unexpected abort caused by a DHCPv6 decline message
https://notcve.org/view.php?id=CVE-2011-0413
The DHCPv6 server in ISC DHCP 4.0.x and 4.1.x before 4.1.2-P1, 4.0-ESV and 4.1-ESV before 4.1-ESV-R1, and 4.2.x before 4.2.1b1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) by sending a message over IPv6 for a declined and abandoned address. El servidor DHCPv6 en ISC DHCP v4.0.x y v4.1.x anterior a v.4.1.2-P1, v.4.0-ESV y v.4.1-ESV anterior a v.4.1-ESV-R1, y v.4.2.x anterior a v.4.2.1b1 permite a atacantes remotos provocar una denegación de servicio enviando mensajes sobre IPv6 para un declinado y abandono de la dirección. • http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053644.html http://secunia.com/advisories/43006 http://secunia.com/advisories/43104 http://secunia.com/advisories/43167 http://secunia.com/advisories/43354 http://secunia.com/advisories/43613 http://securitytracker.com/id?1024999 http://www.debian.org/security/2011/dsa-2184 http://www.isc.org/software/dhcp/advisories/cve-2011-0413 http://www.kb.cert.org/vuls/id/686084 http://www.mandriva.com/security/ • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 11%CPEs: 2EXPL: 0CVE-2010-3616
https://notcve.org/view.php?id=CVE-2010-3616
ISC DHCP server 4.2 before 4.2.0-P2, when configured to use failover partnerships, allows remote attackers to cause a denial of service (communications-interrupted state and DHCP client service loss) by connecting to a port that is only intended for a failover peer, as demonstrated by a Nagios check_tcp process check to TCP port 520. ISC DHCP Server v4.2 anteriore a v4.2.0-P2, cuando está configurado para utilizar las asociaciones de redundancia, permite a atacantes remotos provocar una denegación de servicio (estado de las comunicaciones interrumpidas y la pérdida de servicio de cliente DHCP) mediante la conexión a un puerto que sólo se diseñó como par de redundancia, como lo demuestra un proceso de chequeo check_tcp al puerto TCP 520. • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052329.html http://secunia.com/advisories/42618 http://secunia.com/advisories/42682 http://www.kb.cert.org/vuls/id/159528 http://www.mandriva.com/security/advisories?name=MDVSA-2011:001 http://www.securityfocus.com/bid/45360 http://www.securitytracker.com/id?1024862 http://www.vupen.com/english/advisories/2010/3208 http://www.vupen.com/english/advisories/2011/0052 https://lists.isc.org/pipermail/dhcp-users& • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 0CVE-2010-3615
https://notcve.org/view.php?id=CVE-2010-3615
named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism. named en ISC BIND 9.7.2-P2 no comprueba todas las localizaciones previstas para las ACLs "allow-query" (permitir consultas), lo que puede permitir a atacantes remotos realizar peticiones con éxito a registros DNS privados a través del mecanismo de consulta DNS estándar. • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051963.html http://osvdb.org/69568 http://secunia.com/advisories/42458 http://secunia.com/advisories/42671 http://securitytracker.com/id?1024817 http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.622190 http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories http://www.isc.org/software/bind/advisories/cve-2010-3615 http://www.kb.cert.org/vuls/id/510208 • CWE-264: Permissions, Privileges, and Access Controls •