ID de Prueba:	1.3.6.1.4.1.25623.1.0.51394
Categoría:	Conectiva Local Security Checks
Título:	Conectiva Security Advisory CLA-2003:562
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory CLA-2003:562. The package dhcp provides a Dynamic Host Configuration Protocol[1] server developed by ISC (ISC DHCPD). During an internal source code audit, the ISC developers found several stack-based buffer overflow vulnerabilities[2,3] in the error handling routines of the minires library. This library is used by the NSUPDATE feature, which is present in dhcp versions newer than 3.0 and allows the DHCP server to dynamically update DNS server records. A remote attacker which can send messages directly to the DHCP server can exploit these vulnerabilities to execute arbitrary code in the server context with the privileges of the root user. The packages provided with this announcement fix these vulnerabilities with a patch from ISC. Please note that Conectiva Linux versions prior to 8 do not ship dhcp 3.0 and therefore are not vulnerable to this problem. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.ietf.org/rfc/rfc2131.txt http://www.cert.org/advisories/CA-2003-01.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0026 http://www.isc.org/products/DHCP/ http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:562 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : High CVSS Score: 7.5
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0026 BugTraq ID: 6627 http://www.securityfocus.com/bid/6627 Bugtraq: 20030122 [securityslackware.com: [slackware-security] New DHCP packages available] (Google Search) http://archives.neohapsis.com/archives/bugtraq/2003-01/0250.html http://www.cert.org/advisories/CA-2003-01.html CERT/CC vulnerability note: VU#284857 http://www.kb.cert.org/vuls/id/284857 Computer Incident Advisory Center Bulletin: N-031 http://www.ciac.org/ciac/bulletins/n-031.shtml Conectiva Linux advisory: CLA-2003:562 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000562 Debian Security Information: DSA-231 (Google Search) http://www.debian.org/security/2003/dsa-231 http://www.mandriva.com/security/advisories?name=MDKSA-2003:007 http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.002.html http://www.redhat.com/support/errata/RHSA-2003-011.html http://www.securitytracker.com/id?1005924 SuSE Security Announcement: SuSE-SA:2003:0006 (Google Search) http://www.suse.com/de/security/2003_006_dhcp.html SuSE Security Announcement: SuSE-SA:2003:006 (Google Search) XForce ISS Database: dhcpd-minires-multiple-bo(11073) https://exchange.xforce.ibmcloud.com/vulnerabilities/11073
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.