[ GLSA 200507-16 ] dhcpcd: Denial of Service vulnerability

[GLSA]

Gentoo Linux Security Advisory

Title: dhcpcd: Denial of Service vulnerability (GLSA 200507-16)
Severity: normal
Exploitable: remote
Date: July 15, 2005
Bug(s): #98394
ID: 200507-16

Synopsis


A vulnerability in dhcpcd may cause the dhcpcd daemon to crash.


Background


dhcpcd is a standards compliant DHCP client daemon. It requests an
IP address and other information from the DHCP server, automatically
configures the network interface, and tries to renew the lease time.


Affected Packages

Package: net-misc/dhcpcd
Vulnerable: < 1.3.22_p4-r11
Unaffected: >= 1.3.22_p4-r11
Architectures: All supported architectures


Description


infamous42md discovered that dhcpcd can be tricked to read past
the end of the supplied DHCP buffer. As a result, this might lead to a
crash of the daemon.


Impact


With a malicious DHCP server an attacker could cause a Denial of
Service by crashing the DHCP client.


Workaround


There is no known workaround at this time.


Resolution


All dhcpcd users should upgrade to the latest available version: