CVE-2012-3570
published 2012-07-25CVE-2012-3570: Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and…
PriorityP425medium5.7CVSS 2.0
AVAACMAuNCNINAC
EPSS
2.57%
83.2th percentile
Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | isc-dhcp | < isc-dhcp 4.2.4-2 (bookworm) | isc-dhcp 4.2.4-2 (bookworm) |
| isc | dhcp | — | — |
| isc | dhcp | — | — |
| isc | dhcp | — | — |
| isc | dhcp | — | — |
| isc | dhcp | — | — |
CVSS provenance
nvdv2.05.7MEDIUMAV:A/AC:M/Au:N/C:N/I:N/A:C
osv5.7MEDIUM
vendor_debian5.7MEDIUM
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c23j-xrx5-hcrf: Buffer overflow in ISC DHCP 4
ghsa_unreviewed·2022-05-17
CVE-2012-3570 [MEDIUM] CWE-119 GHSA-c23j-xrx5-hcrf: Buffer overflow in ISC DHCP 4
Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.
OSV
CVE-2012-3570: Buffer overflow in ISC DHCP 4
osv·2012-07-25·CVSS 5.7
CVE-2012-3570 [MEDIUM] CVE-2012-3570: Buffer overflow in ISC DHCP 4
Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.
Red Hat
dhcp: DoS in DHCPv6 due to error in handling malformed client identifiers
vendor_redhat·2012-07-24·CVSS 5.7
CVE-2012-3570 [MEDIUM] dhcp: DoS in DHCPv6 due to error in handling malformed client identifiers
dhcp: DoS in DHCPv6 due to error in handling malformed client identifiers
Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.
Statement: Not vulnerable. This issue did not affect the versions of dhcp as shipped with Red Hat Enterprise Linux 5 and 6.
Package: dhcp (Red Hat Enterprise Linux 5) - Not affected
Package: dhcp (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2012-3570: isc-dhcp - Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, ...
vendor_debian·2012·CVSS 5.7
CVE-2012-3570 [MEDIUM] CVE-2012-3570: isc-dhcp - Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, ...
Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.
Scope: local
bookworm: resolved (fixed in 4.2.4-2)
bullseye: resolved (fixed in 4.2.4-2)
sid: resolved (fixed in 4.2.4-2)
trixie: resolved (fixed in 4.2.4-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-3570 CVE-2012-3571 CVE-2012-3954 dhcp various flaws [fedora-all]
bugzilla·2012-07-24·CVSS 5.7
CVE-2012-3570 [MEDIUM] CVE-2012-3570 CVE-2012-3571 CVE-2012-3954 dhcp various flaws [fedora-all]
CVE-2012-3570 CVE-2012-3571 CVE-2012-3954 dhcp various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&b
Bugzilla
CVE-2012-3570 dhcp: DoS in DHCPv6 due to error in handling malformed client identifiers
bugzilla·2012-07-23·CVSS 5.7
CVE-2012-3570 [MEDIUM] CVE-2012-3570 dhcp: DoS in DHCPv6 due to error in handling malformed client identifiers
CVE-2012-3570 dhcp: DoS in DHCPv6 due to error in handling malformed client identifiers
An unexpected client identifier parameter can cause the ISC DHCP daemon to
segmentation fault when running in DHCPv6 mode, resulting in a denial of
service to further client requests. In order to exploit this condition, an
attacker must be able to send requests to the DHCP server.
ISC DHCP versions 4.2.x are vulnerable to this flaw; earlier versions are not affected.
Acknowledgements:
Upstream acknowledges Markus Hietava of Codenomicon CROSS project as the original reporter of this issue.
Discussion:
Statement:
Not vulnerable. This issue did not affect the versions of dhcp as shipped with Red Hat Enterprise Linux 5 and 6.
---
This is now public:
https://kb.isc.org/article/AA-00714
---
Create
http://lists.opensuse.org/opensuse-updates/2012-08/msg00030.htmlhttp://security.gentoo.org/glsa/glsa-201301-06.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:115http://www.securityfocus.com/bid/54665https://kb.isc.org/article/AA-00714http://lists.opensuse.org/opensuse-updates/2012-08/msg00030.htmlhttp://security.gentoo.org/glsa/glsa-201301-06.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:115http://www.securityfocus.com/bid/54665https://kb.isc.org/article/AA-00714
2012-07-25
Published