CVE-2007-5365

Published: Oct 11, 2007Modified: Apr 23, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

Affected (222)

Products: Debian: Debian Linux · Openbsd: Openbsd · Redhat: Enterprise Linux, Linux Advanced Workstation · +2 more

Show all products

Debian: Debian Linux · Openbsd: Openbsd · Redhat: Enterprise Linux, Linux Advanced Workstation · Sun: Opensolaris, Solaris · Ubuntu: Ubuntu Linux

1 product

1 product

2 products

Linux Advanced Workstation

2 products

1 product

Configuration A

222 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 3.1
Debian Debian Linux	Version 4.0
Openbsd Openbsd	Version 4.0
Openbsd Openbsd	Version 4.1
Openbsd Openbsd	Version 4.2
Redhat Enterprise Linux	Version 2.1
Redhat Enterprise Linux	Version 2.1
Redhat Linux Advanced Workstation	Version 2.1
Sun Opensolaris	Version snv_01
Sun Opensolaris	Version snv_01
Sun Opensolaris	Version snv_02
Sun Opensolaris	Version snv_02
Sun Opensolaris	Version snv_03
Sun Opensolaris	Version snv_03
Sun Opensolaris	Version snv_04
Sun Opensolaris	Version snv_04
Sun Opensolaris	Version snv_05
Sun Opensolaris	Version snv_05
Sun Opensolaris	Version snv_06
Sun Opensolaris	Version snv_06
Sun Opensolaris	Version snv_07
Sun Opensolaris	Version snv_07
Sun Opensolaris	Version snv_08
Sun Opensolaris	Version snv_08
Sun Opensolaris	Version snv_09
Sun Opensolaris	Version snv_09
Sun Opensolaris	Version snv_100
Sun Opensolaris	Version snv_100
Sun Opensolaris	Version snv_101
Sun Opensolaris	Version snv_101
Sun Opensolaris	Version snv_102
Sun Opensolaris	Version snv_102
Sun Opensolaris	Version snv_10
Sun Opensolaris	Version snv_10
Sun Opensolaris	Version snv_11
Sun Opensolaris	Version snv_11
Sun Opensolaris	Version snv_12
Sun Opensolaris	Version snv_12
Sun Opensolaris	Version snv_13
Sun Opensolaris	Version snv_13
Sun Opensolaris	Version snv_14
Sun Opensolaris	Version snv_14
Sun Opensolaris	Version snv_15
Sun Opensolaris	Version snv_15
Sun Opensolaris	Version snv_16
Sun Opensolaris	Version snv_16
Sun Opensolaris	Version snv_17
Sun Opensolaris	Version snv_17
Sun Opensolaris	Version snv_18
Sun Opensolaris	Version snv_18
Sun Opensolaris	Version snv_19
Sun Opensolaris	Version snv_19
Sun Opensolaris	Version snv_20
Sun Opensolaris	Version snv_20
Sun Opensolaris	Version snv_21
Sun Opensolaris	Version snv_21
Sun Opensolaris	Version snv_22
Sun Opensolaris	Version snv_22
Sun Opensolaris	Version snv_23
Sun Opensolaris	Version snv_23
Sun Opensolaris	Version snv_24
Sun Opensolaris	Version snv_24
Sun Opensolaris	Version snv_25
Sun Opensolaris	Version snv_25
Sun Opensolaris	Version snv_26
Sun Opensolaris	Version snv_26
Sun Opensolaris	Version snv_27
Sun Opensolaris	Version snv_27
Sun Opensolaris	Version snv_28
Sun Opensolaris	Version snv_28
Sun Opensolaris	Version snv_29
Sun Opensolaris	Version snv_29
Sun Opensolaris	Version snv_30
Sun Opensolaris	Version snv_30
Sun Opensolaris	Version snv_31
Sun Opensolaris	Version snv_31
Sun Opensolaris	Version snv_32
Sun Opensolaris	Version snv_32
Sun Opensolaris	Version snv_33
Sun Opensolaris	Version snv_33
Sun Opensolaris	Version snv_34
Sun Opensolaris	Version snv_34
Sun Opensolaris	Version snv_35
Sun Opensolaris	Version snv_35
Sun Opensolaris	Version snv_36
Sun Opensolaris	Version snv_36
Sun Opensolaris	Version snv_37
Sun Opensolaris	Version snv_37
Sun Opensolaris	Version snv_38
Sun Opensolaris	Version snv_38
Sun Opensolaris	Version snv_39
Sun Opensolaris	Version snv_39
Sun Opensolaris	Version snv_40
Sun Opensolaris	Version snv_40
Sun Opensolaris	Version snv_41
Sun Opensolaris	Version snv_41
Sun Opensolaris	Version snv_42
Sun Opensolaris	Version snv_42
Sun Opensolaris	Version snv_43
Sun Opensolaris	Version snv_43
Sun Opensolaris	Version snv_44
Sun Opensolaris	Version snv_44
Sun Opensolaris	Version snv_45
Sun Opensolaris	Version snv_45
Sun Opensolaris	Version snv_46
Sun Opensolaris	Version snv_46
Sun Opensolaris	Version snv_47
Sun Opensolaris	Version snv_47
Sun Opensolaris	Version snv_48
Sun Opensolaris	Version snv_48
Sun Opensolaris	Version snv_49
Sun Opensolaris	Version snv_49
Sun Opensolaris	Version snv_50
Sun Opensolaris	Version snv_50
Sun Opensolaris	Version snv_51
Sun Opensolaris	Version snv_51
Sun Opensolaris	Version snv_52
Sun Opensolaris	Version snv_52
Sun Opensolaris	Version snv_53
Sun Opensolaris	Version snv_53
Sun Opensolaris	Version snv_54
Sun Opensolaris	Version snv_54
Sun Opensolaris	Version snv_55
Sun Opensolaris	Version snv_55
Sun Opensolaris	Version snv_56
Sun Opensolaris	Version snv_56
Sun Opensolaris	Version snv_57
Sun Opensolaris	Version snv_57
Sun Opensolaris	Version snv_58
Sun Opensolaris	Version snv_58
Sun Opensolaris	Version snv_59
Sun Opensolaris	Version snv_59
Sun Opensolaris	Version snv_60
Sun Opensolaris	Version snv_60
Sun Opensolaris	Version snv_61
Sun Opensolaris	Version snv_61
Sun Opensolaris	Version snv_62
Sun Opensolaris	Version snv_62
Sun Opensolaris	Version snv_63
Sun Opensolaris	Version snv_63
Sun Opensolaris	Version snv_64
Sun Opensolaris	Version snv_64
Sun Opensolaris	Version snv_65
Sun Opensolaris	Version snv_65
Sun Opensolaris	Version snv_66
Sun Opensolaris	Version snv_66
Sun Opensolaris	Version snv_67
Sun Opensolaris	Version snv_67
Sun Opensolaris	Version snv_68
Sun Opensolaris	Version snv_68
Sun Opensolaris	Version snv_69
Sun Opensolaris	Version snv_69
Sun Opensolaris	Version snv_70
Sun Opensolaris	Version snv_70
Sun Opensolaris	Version snv_71
Sun Opensolaris	Version snv_71
Sun Opensolaris	Version snv_72
Sun Opensolaris	Version snv_72
Sun Opensolaris	Version snv_73
Sun Opensolaris	Version snv_73
Sun Opensolaris	Version snv_74
Sun Opensolaris	Version snv_74
Sun Opensolaris	Version snv_75
Sun Opensolaris	Version snv_75
Sun Opensolaris	Version snv_76
Sun Opensolaris	Version snv_76
Sun Opensolaris	Version snv_77
Sun Opensolaris	Version snv_77
Sun Opensolaris	Version snv_78
Sun Opensolaris	Version snv_78
Sun Opensolaris	Version snv_79
Sun Opensolaris	Version snv_79
Sun Opensolaris	Version snv_80
Sun Opensolaris	Version snv_80
Sun Opensolaris	Version snv_81
Sun Opensolaris	Version snv_81
Sun Opensolaris	Version snv_82
Sun Opensolaris	Version snv_82
Sun Opensolaris	Version snv_83
Sun Opensolaris	Version snv_83
Sun Opensolaris	Version snv_84
Sun Opensolaris	Version snv_84
Sun Opensolaris	Version snv_85
Sun Opensolaris	Version snv_85
Sun Opensolaris	Version snv_86
Sun Opensolaris	Version snv_86
Sun Opensolaris	Version snv_87
Sun Opensolaris	Version snv_87
Sun Opensolaris	Version snv_88
Sun Opensolaris	Version snv_88
Sun Opensolaris	Version snv_89
Sun Opensolaris	Version snv_89
Sun Opensolaris	Version snv_90
Sun Opensolaris	Version snv_90
Sun Opensolaris	Version snv_91
Sun Opensolaris	Version snv_91
Sun Opensolaris	Version snv_92
Sun Opensolaris	Version snv_92
Sun Opensolaris	Version snv_93
Sun Opensolaris	Version snv_93
Sun Opensolaris	Version snv_94
Sun Opensolaris	Version snv_94
Sun Opensolaris	Version snv_95
Sun Opensolaris	Version snv_95
Sun Opensolaris	Version snv_96
Sun Opensolaris	Version snv_96
Sun Opensolaris	Version snv_97
Sun Opensolaris	Version snv_97
Sun Opensolaris	Version snv_98
Sun Opensolaris	Version snv_98
Sun Opensolaris	Version snv_99
Sun Opensolaris	Version snv_99
Sun Solaris	Version 10.0
Sun Solaris	Version 10.0
Sun Solaris	Version 8.0
Sun Solaris	Version 8.0
Sun Solaris	Version 9.0
Sun Solaris	Version 9.0
Ubuntu Ubuntu Linux	Version 6.06 _nil_
Ubuntu Ubuntu Linux	Version 6.10
Ubuntu Ubuntu Linux	Version 7.04
Ubuntu Ubuntu Linux	Version 7.10

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (54)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446354

Source: cve@mitre.org

http://secunia.com/advisories/27160

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27273

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27338

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27350

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/32668

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1021157

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-21-109077-21-1

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-243806-1

Source: cve@mitre.org

http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1962

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1388

Source: cve@mitre.org

http://www.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/dhcpd/options.c

Source: cve@mitre.org

Patch

http://www.openbsd.org/errata40.html#016_dhcpd

Source: cve@mitre.org

Patch

http://www.openbsd.org/errata41.html#010_dhcpd

Source: cve@mitre.org

Patch

http://www.openbsd.org/errata42.html#001_dhcpd

Source: cve@mitre.org

Patch

http://www.redhat.com/support/errata/RHSA-2007-0970.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/482085/100/100/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/483230/100/100/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/25984

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/32213

Source: cve@mitre.org

http://www.securitytracker.com/id?1018794

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-531-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-531-2

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/3088

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/37045

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5817

Source: cve@mitre.org

https://www.exploit-db.com/exploits/4601

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446354