Summary
The remote host is missing an update to dhcp3
announced via advisory DSA 1833-2.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201833-2
Insight
The previous dhcp3 update (DSA-1833-1) did not properly apply the required changes to the stable (lenny) version. The old stable (etch) version is not affected by this problem.
The original advisory description follows.
Several remote vulnerabilities have been discovered in ISC's DHCP implementation:
It was discovered that dhclient does not properly handle overlong subnet mask options, leading to a stack-based buffer overflow and possible arbitrary code execution. (CVE-2009-0692)
Christoph Biedl discovered that the DHCP server may terminate when receiving certain well-formed DHCP requests, provided that the server configuration mixes host definitions using dhcp-client-identifier and hardware ethernet. This vulnerability only affects the lenny versions of dhcp3-server and dhcp3-server-ldap. (CVE-2009-1892)
For the stable distribution (lenny), this problem has been fixed in version 3.1.1-6+lenny3.
We recommend that you upgrade your dhcp3 packages.
Severity
Classification
-
CVE CVE-2009-0692, CVE-2009-1892 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities