CVE-2006-2372

published 2006-07-11

CVE-2006-2372: Buffer overflow in the DHCP Client service for Microsoft Windows 2000 SP4, Windows XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to execute…

Priority P2 69 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Buffer overflow in the DHCP Client service for Microsoft Windows 2000 SP4, Windows XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a crafted DHCP response.

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2054.tar.gz↗

filename 07212006-MS06_036_DHCP_Client.tar.gz↗

• → Exploit is delivered via a crafted DHCP response (broadcast) targeting the Windows DHCP Client service — monitor for malformed/oversized DHCP OFFER or ACK packets on UDP port 68 (client-side) originating from unexpected sources on the network. ↗
• → Attack vector is a broadcast DHCP response — a rogue DHCP server on the local segment can trigger the overflow; detect rogue DHCP servers by alerting on DHCP OFFER/ACK packets from unexpected MAC/IP sources. ↗

• · Affected platforms are Windows 2000 SP4, Windows XP SP1/SP2, and Windows Server 2003 up to SP1 only — patched systems (Server 2003 SP2+, XP SP3+) are not vulnerable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119