CVE-2007-5365

Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

80.27% chance of exploitation in the next 30 days, 100th percentile

Published

2007-10-11

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.securityfocus.com/archive/1/483230/100/100/threaded

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/4601

Security advisories

• http://secunia.com/advisories/27160
• http://secunia.com/advisories/27273
• http://secunia.com/advisories/27338
• http://secunia.com/advisories/27350
• http://secunia.com/advisories/32668
• http://www.vupen.com/english/advisories/2008/3088
• http://www.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/dhcpd/options.c
• http://www.openbsd.org/errata40.html#016_dhcpd
• http://www.openbsd.org/errata41.html#010_dhcpd
• http://www.openbsd.org/errata42.html#001_dhcpd
• http://www.securityfocus.com/bid/25984
• http://www.redhat.com/support/errata/RHSA-2007-0970.html
• http://www.securityfocus.com/bid/32213
• http://www.ubuntu.com/usn/usn-531-1
• http://www.ubuntu.com/usn/usn-531-2

References

• CVE Record
• NVD entry