Test Kennung:	1.3.6.1.4.1.25623.1.0.51394
Kategorie:	Conectiva Local Security Checks
Titel:	Conectiva Security Advisory CLA-2003:562
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing updates announced in advisory CLA-2003:562. The package dhcp provides a Dynamic Host Configuration Protocol[1] server developed by ISC (ISC DHCPD). During an internal source code audit, the ISC developers found several stack-based buffer overflow vulnerabilities[2,3] in the error handling routines of the minires library. This library is used by the NSUPDATE feature, which is present in dhcp versions newer than 3.0 and allows the DHCP server to dynamically update DNS server records. A remote attacker which can send messages directly to the DHCP server can exploit these vulnerabilities to execute arbitrary code in the server context with the privileges of the root user. The packages provided with this announcement fix these vulnerabilities with a patch from ISC. Please note that Conectiva Linux versions prior to 8 do not ship dhcp 3.0 and therefore are not vulnerable to this problem. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.ietf.org/rfc/rfc2131.txt http://www.cert.org/advisories/CA-2003-01.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0026 http://www.isc.org/products/DHCP/ http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:562 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : High CVSS Score: 7.5
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0026 BugTraq ID: 6627 http://www.securityfocus.com/bid/6627 Bugtraq: 20030122 [securityslackware.com: [slackware-security] New DHCP packages available] (Google Search) http://archives.neohapsis.com/archives/bugtraq/2003-01/0250.html http://www.cert.org/advisories/CA-2003-01.html CERT/CC vulnerability note: VU#284857 http://www.kb.cert.org/vuls/id/284857 Computer Incident Advisory Center Bulletin: N-031 http://www.ciac.org/ciac/bulletins/n-031.shtml Conectiva Linux advisory: CLA-2003:562 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000562 Debian Security Information: DSA-231 (Google Search) http://www.debian.org/security/2003/dsa-231 http://www.mandriva.com/security/advisories?name=MDKSA-2003:007 http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.002.html http://www.redhat.com/support/errata/RHSA-2003-011.html http://www.securitytracker.com/id?1005924 SuSE Security Announcement: SuSE-SA:2003:0006 (Google Search) http://www.suse.com/de/security/2003_006_dhcp.html SuSE Security Announcement: SuSE-SA:2003:006 (Google Search) XForce ISS Database: dhcpd-minires-multiple-bo(11073) https://exchange.xforce.ibmcloud.com/vulnerabilities/11073
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.