CVE-2004-0460

3 documents3 sources
Severity
10.0CRITICAL
EPSS
67.5%
top 1.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Infoblox DNS ONE ApplianceISC DhcpdMandrakesoft Mandrake Linux+3 more
Timeline
PublishedAug 6
Latest updateApr 29

Description

Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via multiple hostname options in (1) DISCOVER, (2) OFFER, (3) REQUEST, (4) ACK, or (5) NAK messages, which can generate a long string when writing to a log file.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages6 packages

▶NVDisc/dhcpd3.0.1
▶NVDsuse/suse_linux7 versions+6
▶NVDredhat/fedora_corecore_2.0
▶NVDinfoblox/dns_one_appliance2.3.1_r5, 2.4.0.8, 2.4.0.8a+2

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-qhjw-939w-vp4h: Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3↗2022-04-29
▶
CVEList
CVE-2004-0460: Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3↗2004-06-24
▶
CVE-2004-0460 (CRITICAL CVSS 10) | Buffer overflow in the logging capa | cvebase.io