|
|
Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2002:037: dhcp Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the dhcp package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2002:037 (dhcp).
Fermin J. Serna discovered a problem in the dhcp server and client package from
versions 3.0 to 3.0.1rc8, which are affected by a format string vulnerability
that can be exploited remotely. By default, these versions of DHCP are compiled
with the dns update feature enabled, which allows DHCP to update DNS records.
The code that logs this update has an exploitable format string vulnerability
the update message can contain data provided by the attacker, such as a
hostname. A successful exploitation could give the attacker elevated rights
equivalent to the user running the DHCP daemon, which is the user dhcpd in
Mandrake Linux 8.x, but root in earlier versions.
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2002:037
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
