ISC DHCPD Remote Format String Vulnerability

BID:11591

Info

ISC DHCPD Remote Format String Vulnerability

Bugtraq ID: 11591
Class: Input Validation Error
CVE: CVE-2004-1006
Remote: Yes
Local: No
Published: Nov 02 2004 12:00AM
Updated: Jul 12 2009 08:06AM
Credit: Discovery of this vulnerability is credited to [email protected].
Vulnerable: Redhat Linux 7.3 i686
Redhat Linux 7.3 i386
Redhat Linux 7.3
Redhat Enterprise Linux ES 2.1 IA64
Redhat Enterprise Linux ES 2.1
Redhat Enterprise Linux AS 2.1 IA64
Redhat Enterprise Linux AS 2.1
Redhat Advanced Workstation for the Itanium Processor 2.1 IA64
Redhat Advanced Workstation for the Itanium Processor 2.1
ISC DHCPD 3.0.1 rc9
+ Conectiva Linux Enterprise Edition 1.0
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ OpenPKG OpenPKG 1.1
+ SuSE Linux 8.1
ISC DHCPD 3.0.1 rc8
ISC DHCPD 3.0.1 rc7
- FreeBSD FreeBSD 4.5
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1.1
ISC DHCPD 3.0.1 rc6
+ SuSE Linux 8.0 i386
 + SuSE Linux 8.0
ISC DHCPD 3.0.1 rc5
ISC DHCPD 3.0.1 rc4
+ OpenPKG OpenPKG 1.0
ISC DHCPD 3.0.1 rc3
ISC DHCPD 3.0.1 rc2
ISC DHCPD 3.0.1 rc14
ISC DHCPD 3.0.1 rc13
ISC DHCPD 3.0.1 rc12
ISC DHCPD 3.0.1 rc11
+ OpenPKG OpenPKG 1.2
+ OpenPKG OpenPKG Current
 ISC DHCPD 3.0.1 rc10
+ OpenPKG OpenPKG Current
 ISC DHCPD 3.0.1 rc1
ISC DHCPD 3.0 rc4
+ SuSE Linux 7.2 i386
 + SuSE Linux 7.2
ISC DHCPD 3.0 rc12
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.3
ISC DHCPD 3.0 pl2
ISC DHCPD 3.0 pl1
+ Gentoo Linux 1.4 _rc2
 + Gentoo Linux 1.4 _rc1
 + Redhat Linux 8.0 i386
 + Redhat Linux 8.0
+ Slackware Linux 8.1
ISC DHCPD 3.0 b2pl9
+ Mandriva Linux Mandrake 7.2
ISC DHCPD 3.0 b2pl23
+ MandrakeSoft Single Network Firewall 7.2
ISC DHCPD 3.0
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
+ MandrakeSoft Multi Network Firewall 2.0
+ Mandriva Linux Mandrake 9.0
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
- S.u.S.E. Linux Connectivity Server
- S.u.S.E. Linux Database Server 0
 - S.u.S.E. Linux Enterprise Server for S/390
- S.u.S.E. SuSE eMail Server III
- SuSE Linux 8.0
- SuSE Linux 7.3
- SuSE Linux 7.2
- SuSE SUSE Linux Enterprise Server 7
 ISC DHCPD 2.0.pl5
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
Not Vulnerable: ISC DHCPD 3.0.2rc1

Discussion

ISC DHCPD Remote Format String Vulnerability

A remote format string vulnerability is reported in the ISC DHCPD server package. User supplied data is logged in an unsafe fashion. Exploitation of this vulnerability may result in arbitrary code being executed by the DHCP server. Although unconfirmed it is conjectured that this issue may only be exploitable when debugging functionality is enabled.

Exploit / POC

ISC DHCPD Remote Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

ISC DHCPD Remote Format String Vulnerability

Solution:
It is reported that the vendor has released an update to address this vulnerability. This update is reported to be located at:
ftp://ftp.isc.org/isc/dhcp/dhcp-3.0.2rc1.tar.gz
This is not confirmed by Symantec, users are advised to contact the vendor for further information.

Debian has released an advisory (DSA 584-1) and fixes to address this issue. Please see the referenced advisory for further information regarding obtaining and applying appropriate updates.

RedHat Linux has released advisory RHSA-2005:212-06 to address this issue in RedHat Enterprise Linux operating systems. Please see the referenced advisory for further information.

RedHat Fedora has released Fedora Legacy security advisory FLSA:152835 addressing this issue. Please see the referenced advisory for further information.


ISC DHCPD 2.0.pl5

References

ISC DHCPD Remote Format String Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report