CVE-2009-0692

Published: Jul 14, 2009Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option.

Affected (5)

Products: Isc: Dhcp

Isc

1 product

Dhcp

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Isc Dhcp	Version 2.0
Isc Dhcp	Version 3.0
Isc Dhcp	Version 3.1
Isc Dhcp	Version 4.0
Isc Dhcp	Version 4.1.0

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (72)

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-010.txt.asc

Source: cret@cert.org

http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083

Source: cret@cert.org

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00003.html

Source: cret@cert.org

http://secunia.com/advisories/35785

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/35829

Source: cret@cert.org

http://secunia.com/advisories/35830

Source: cret@cert.org

http://secunia.com/advisories/35831

Source: cret@cert.org

http://secunia.com/advisories/35832

Source: cret@cert.org

http://secunia.com/advisories/35841

Source: cret@cert.org

http://secunia.com/advisories/35849

Source: cret@cert.org

http://secunia.com/advisories/35850

Source: cret@cert.org

http://secunia.com/advisories/35851

Source: cret@cert.org

http://secunia.com/advisories/35880

Source: cret@cert.org

http://secunia.com/advisories/36457

Source: cret@cert.org

http://secunia.com/advisories/37342

Source: cret@cert.org

http://secunia.com/advisories/40551

Source: cret@cert.org

http://security.gentoo.org/glsa/glsa-200907-12.xml

Source: cret@cert.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561471

Source: cret@cert.org

http://www.debian.org/security/2009/dsa-1833

Source: cret@cert.org

http://www.kb.cert.org/vuls/id/410676

Source: cret@cert.org

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2009:151

Source: cret@cert.org

http://www.osvdb.org/55819

Source: cret@cert.org

http://www.redhat.com/support/errata/RHSA-2009-1136.html

Source: cret@cert.org

http://www.redhat.com/support/errata/RHSA-2009-1154.html

Source: cret@cert.org

http://www.securityfocus.com/bid/35668

Source: cret@cert.org

http://www.securitytracker.com/id?1022548

Source: cret@cert.org

http://www.ubuntu.com/usn/usn-803-1

Source: cret@cert.org

http://www.vupen.com/english/advisories/2009/1891

Source: cret@cert.org

http://www.vupen.com/english/advisories/2010/1796

Source: cret@cert.org

https://bugzilla.redhat.com/show_bug.cgi?id=507717

Source: cret@cert.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10758

Source: cret@cert.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5941

Source: cret@cert.org

https://www.isc.org/downloadables/12

Source: cret@cert.org

https://www.isc.org/node/468

Source: cret@cert.org

PatchVendor Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01177.html

Source: cret@cert.org

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00340.html

Source: cret@cert.org

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-010.txt.asc