CVSS: 6.5EPSS: 0%CPEs: 35EXPL: 0CVE-2022-2929 – DHCP memory leak
https://notcve.org/view.php?id=CVE-2022-2929
In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory. En ISC DHCP versiones 1.0 anteriores a 4.4.3, ISC DHCP versiones 4.1-ESV-R1 anteriores a 4.1-ESV-R16-P1, un sistema con acceso a un servidor DHCP, enviando paquetes DHCP diseñados para incluir etiquetas fqdn de más de 63 bytes, podría llegar a causar a el servidor quedarse sin memoria A vulnerability was found in the DHCP server where the "fqdn_universe_decode()" function allocates buffer space for the contents of option 81 (fqdn) data received in a DHCP packet. The maximum length of a DNS "label" is 63 bytes. The function tests the length byte of each label contained in the "fqdn"; if it finds a label whose length byte value is larger than 63, it returns without dereferencing the buffer space. This issue causes a memory leak. • https://kb.isc.org/docs/cve-2022-2929 https://lists.debian.org/debian-lts-announce/2022/10/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SARIK7KZ7MGQIWDRWZFAOSQSPXY4GOU https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQXYCIWUDILRCNBAIMVFCSGXBRKEPB4K https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6IBFH4MRRNJQVWEKILQ6I6CXWW766FX https://security.gentoo.org/glsa/202305-22 https:/&#x • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.1EPSS: 0%CPEs: 102EXPL: 0CVE-2011-4868
https://notcve.org/view.php?id=CVE-2011-4868
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update. La funcionalidad de registro en el dhcpd de ISC DHCP anterior a v4.2.3-P2, cuando se utiliza DNS dinámico (DDNS) y direcciones IPv6, no maneja correctamente la estructura de arrendamiento (lease structure) DHCPv6, permitiendo a atacantes remotos provocar una denegación de servicio (puntero a NULL y el caída del servicio) mediante paquetes especialmente elaborados en relación con una actualización lease-status. • http://security.gentoo.org/glsa/glsa-201301-06.xml https://deepthought.isc.org/article/AA-00595 https://kb.isc.org/article/AA-00705 https://www.isc.org/software/dhcp/advisories/cve-2011-4868 • CWE-399: Resource Management Errors •
CVSS: 7.8EPSS: 96%CPEs: 92EXPL: 0CVE-2011-2748 – dhcp: denial of service flaws
https://notcve.org/view.php?id=CVE-2011-2748
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet. El servidor en ISC DHCP v3.x y v4.x anterior a v4.2.2, v3.1-ESV anterior a v3.1-ESV-R3, y v4.1-ESV anterior a v4.1-ESV-R3 permite a atacantes remotos provocar una denegación de servicio (salida de demonio) a través de un paquete DHCP manipulado. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065176.html http://lists.opensuse.org/opensuse-updates/2011-09/msg00014.html http://redmine.pfsense.org/issues/1888 http://secunia.com/advisories/45582 http://secunia.com/advisories/45595 http://secunia.com/advisories/45629 http://secunia.com/advisories/45639 http://secunia.com/advisories/45817 http://secunia.com/advisories/45918 http://secunia.com • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 95%CPEs: 92EXPL: 0CVE-2011-2749 – dhcp: denial of service flaws
https://notcve.org/view.php?id=CVE-2011-2749
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet. El servidor en ISC DHCP v3.x y v4.x anterior a v4.2.2, v3.1-ESV anterior a v3.1-ESV-R3, y v4.1-ESV anterior a v4.1-ESV-R3 permite a atacantes remotos provocar una denegación de servicio (salida de demonio) a través de un paquete BOOTP manipulado. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065176.html http://lists.opensuse.org/opensuse-updates/2011-09/msg00014.html http://secunia.com/advisories/45582 http://secunia.com/advisories/45595 http://secunia.com/advisories/45629 http://secunia.com/advisories/45639 http://secunia.com/advisories/45817 http://secunia.com/advisories/45918 http://secunia.com/advisories/46780 http://security.gentoo.or • CWE-20: Improper Input Validation •
CVSS: 7.9EPSS: 96%CPEs: 67EXPL: 1CVE-2011-0997 – dhclient: insufficient sanitization of certain DHCP response values
https://notcve.org/view.php?id=CVE-2011-0997
dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script. dhclient en ISC DHCP 3.0.x hasta la versión 4.2.x en versiones anteriores a 4.2.1-P1, 3.1-ESV en versiones anteriores a 3.1-ESV-R1 y 4.1-ESV en versiones anteriores a 4.1-ESV-R2 permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres shell en un nombre de anfitrión obtenido de un mensaje DHCP, como es demostrado por un nombre de anfitrión dado por dhclient-script. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057888.html http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058279.html http://marc.info/?l=bugtraq&m=133226187115472&w=2 http://secunia.com/advisories/44037 http://secunia.com/advisories/44048 http://secunia.com/advisories/44089 http://secunia.com/advisories/44090 http://secunia.com/advisories/44103 http://secunia.com/advisories/44127&# • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •