Test ID:	1.3.6.1.4.1.25623.1.0.51394
Category:	Conectiva Local Security Checks
Title:	Conectiva Security Advisory CLA-2003:562
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory CLA-2003:562. The package dhcp provides a Dynamic Host Configuration Protocol[1] server developed by ISC (ISC DHCPD). During an internal source code audit, the ISC developers found several stack-based buffer overflow vulnerabilities[2,3] in the error handling routines of the minires library. This library is used by the NSUPDATE feature, which is present in dhcp versions newer than 3.0 and allows the DHCP server to dynamically update DNS server records. A remote attacker which can send messages directly to the DHCP server can exploit these vulnerabilities to execute arbitrary code in the server context with the privileges of the root user. The packages provided with this announcement fix these vulnerabilities with a patch from ISC. Please note that Conectiva Linux versions prior to 8 do not ship dhcp 3.0 and therefore are not vulnerable to this problem. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.ietf.org/rfc/rfc2131.txt http://www.cert.org/advisories/CA-2003-01.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0026 http://www.isc.org/products/DHCP/ http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:562 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : High CVSS Score: 7.5
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0026 BugTraq ID: 6627 http://www.securityfocus.com/bid/6627 Bugtraq: 20030122 [securityslackware.com: [slackware-security] New DHCP packages available] (Google Search) http://archives.neohapsis.com/archives/bugtraq/2003-01/0250.html http://www.cert.org/advisories/CA-2003-01.html CERT/CC vulnerability note: VU#284857 http://www.kb.cert.org/vuls/id/284857 Computer Incident Advisory Center Bulletin: N-031 http://www.ciac.org/ciac/bulletins/n-031.shtml Conectiva Linux advisory: CLA-2003:562 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000562 Debian Security Information: DSA-231 (Google Search) http://www.debian.org/security/2003/dsa-231 http://www.mandriva.com/security/advisories?name=MDKSA-2003:007 http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.002.html http://www.redhat.com/support/errata/RHSA-2003-011.html http://www.securitytracker.com/id?1005924 SuSE Security Announcement: SuSE-SA:2003:0006 (Google Search) http://www.suse.com/de/security/2003_006_dhcp.html SuSE Security Announcement: SuSE-SA:2003:006 (Google Search) XForce ISS Database: dhcpd-minires-multiple-bo(11073) https://exchange.xforce.ibmcloud.com/vulnerabilities/11073
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.