CVE-2007-5365

Published: 11/10/2007 Updated: 15/10/2018

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 725

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 up to and including 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote malicious users to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sun opensolaris snv 36
sun opensolaris snv 30
sun opensolaris snv 70
sun opensolaris snv 33
sun opensolaris snv 101
sun opensolaris snv 90
sun opensolaris snv 93
sun opensolaris snv 85
sun opensolaris snv 57
sun opensolaris snv 87
openbsd openbsd 4.1
sun opensolaris snv 26
sun opensolaris snv 50
redhat enterprise linux 2.1
sun opensolaris snv 73
sun opensolaris snv 72
sun opensolaris snv 67
ubuntu ubuntu linux 6.06
sun opensolaris snv 91
sun opensolaris snv 92
sun opensolaris snv 01
sun opensolaris snv 77
sun opensolaris snv 18
sun opensolaris snv 53
sun opensolaris snv 41
sun opensolaris snv 74
sun opensolaris snv 11
sun opensolaris snv 66
sun opensolaris snv 27
sun opensolaris snv 39
sun opensolaris snv 23
sun opensolaris snv 80
ubuntu ubuntu linux 7.10
sun opensolaris snv 46
sun opensolaris snv 52
sun opensolaris snv 07
sun opensolaris snv 82
sun opensolaris snv 55
redhat linux advanced workstation 2.1
sun opensolaris snv 24
sun opensolaris snv 88
sun opensolaris snv 31
sun opensolaris snv 05
debian debian linux 3.1
sun opensolaris snv 56
sun opensolaris snv 43
sun opensolaris snv 04
sun opensolaris snv 58
sun opensolaris snv 54
ubuntu ubuntu linux 7.04
sun opensolaris snv 40
sun opensolaris snv 84
sun opensolaris snv 65
sun solaris 8.0
debian debian linux 4.0
sun opensolaris snv 49
sun opensolaris snv 09
sun opensolaris snv 17
sun opensolaris snv 86
sun opensolaris snv 06
sun opensolaris snv 62
sun opensolaris snv 37
sun opensolaris snv 100
sun opensolaris snv 71
sun opensolaris snv 22
sun opensolaris snv 35
sun opensolaris snv 13
sun opensolaris snv 64
sun opensolaris snv 34
sun opensolaris snv 61
sun opensolaris snv 79
sun opensolaris snv 42
sun opensolaris snv 44
sun opensolaris snv 38
sun opensolaris snv 89
sun opensolaris snv 29
sun solaris 9.0
sun opensolaris snv 59
sun opensolaris snv 10
sun solaris 10.0
sun opensolaris snv 45
sun opensolaris snv 28
sun opensolaris snv 78
sun opensolaris snv 08
sun opensolaris snv 96
sun opensolaris snv 48
sun opensolaris snv 99
sun opensolaris snv 97
sun opensolaris snv 25
sun opensolaris snv 51
sun opensolaris snv 63
sun opensolaris snv 83
sun opensolaris snv 16
sun opensolaris snv 12
sun opensolaris snv 81
sun opensolaris snv 94
sun opensolaris snv 19
sun opensolaris snv 98
sun opensolaris snv 32
ubuntu ubuntu linux 6.10
sun opensolaris snv 69
sun opensolaris snv 68
sun opensolaris snv 95
sun opensolaris snv 20
sun opensolaris snv 102
openbsd openbsd 4.2
sun opensolaris snv 02
sun opensolaris snv 14
sun opensolaris snv 60
sun opensolaris snv 03
sun opensolaris snv 21
sun opensolaris snv 75
sun opensolaris snv 76
sun opensolaris snv 15
sun opensolaris snv 47
openbsd openbsd 4.0

USN-531-1 fixed vulnerabilities in dhcp The fixes were incomplete, and only reduced the scope of the vulnerability, without fully solving it This update fixes the problem ...

Nahuel Riva and Gerardo Richarte discovered that the DHCP server did not correctly handle certain client options A remote attacker could send malicious DHCP replies to the server and execute arbitrary code ...

Ubuntu 606 DHCPd bug Remote Denial of Service Exploit Author: RoMaNSoFt <roman@rs-labscom> Exploit-DB Mirror: githubcom/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/4601tgz (1022007-DoS-CVE-2007-5365tgz) # milw0rmcom [2007-11-02] ...

CWE-119 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/dhcpd/options.c http://www.openbsd.org/errata40.html#016_dhcpd http://www.openbsd.org/errata41.html#010_dhcpd http://www.openbsd.org/errata42.html#001_dhcpd http://www.securityfocus.com/bid/25984 http://secunia.com/advisories/27160 http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1962 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446354 http://www.debian.org/security/2007/dsa-1388 http://www.redhat.com/support/errata/RHSA-2007-0970.html http://www.ubuntu.com/usn/usn-531-1 http://www.ubuntu.com/usn/usn-531-2 http://www.securitytracker.com/id?1018794 http://secunia.com/advisories/27273 http://secunia.com/advisories/27350 http://secunia.com/advisories/27338 http://sunsolve.sun.com/search/document.do?assetkey=1-21-109077-21-1 http://securitytracker.com/id?1021157 http://www.securityfocus.com/bid/32213 http://sunsolve.sun.com/search/document.do?assetkey=1-26-243806-1 http://secunia.com/advisories/32668 http://www.vupen.com/english/advisories/2008/3088 https://exchange.xforce.ibmcloud.com/vulnerabilities/37045 https://www.exploit-db.com/exploits/4601 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5817 http://www.securityfocus.com/archive/1/483230/100/100/threaded http://www.securityfocus.com/archive/1/482085/100/100/threaded https://nvd.nist.gov https://usn.ubuntu.com/531-2/https://www.exploit-db.com/exploits/4601/

Get Started

CVE-2007-5365

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect