To: [email protected]Subject: [ MDVSA-2009:153 ] dhcp
Date: Fri, 17 Jul 2009 22:47:00 +0200
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1MRuKb-0003nQ-0r@titan.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:153
http://www.mandriva.com/security/
_______________________________________________________________________
Package : dhcp
Date : July 17, 2009
Affected: 2008.1, Corporate 3.0, Corporate 4.0,
Multi Network Firewall 2.0
_______________________________________________________________________
Problem Description:
A vulnerability has been found and corrected in ISC DHCP:
Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before
3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build
56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455
and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and
ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528;
allows remote attackers to cause a denial of service (daemon crash)
or execute arbitrary code via a malformed DHCP packet with a large
dhcp-max-message-size that triggers a stack-based buffer overflow,
related to servers configured to send many DHCP options to clients
(CVE-2007-0062).
This update provides fixes for this vulnerability.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0062
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.1:
e990b4848d5946aba0cb30da2032eab9 2008.1/i586/dhcp-client-3.0.7-0.1mdv2008.1.i586.rpm
528854b7ab0ff79a33239f704b4404c2 2008.1/i586/dhcp-common-3.0.7-0.1mdv2008.1.i586.rpm
8151495369c79ec8f38d22fb6d7497dd 2008.1/i586/dhcp-devel-3.0.7-0.1mdv2008.1.i586.rpm
886541fa55ffaacc37a53f339f524e42 2008.1/i586/dhcp-doc-3.0.7-0.1mdv2008.1.i586.rpm
09dba31d422d4f888d38411b9d22ec68 2008.1/i586/dhcp-relay-3.0.7-0.1mdv2008.1.i586.rpm
607f5c3a11eac14ba89345ce5ef8b47d 2008.1/i586/dhcp-server-3.0.7-0.1mdv2008.1.i586.rpm
a77a2457b18c1451351a76fdb7472c78 2008.1/SRPMS/dhcp-3.0.7-0.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
3d443dc667a0ba0dfb28655beb79a7a0 2008.1/x86_64/dhcp-client-3.0.7-0.1mdv2008.1.x86_64.rpm
a3b416aca289a48f85b5de72a1f4ac24 2008.1/x86_64/dhcp-common-3.0.7-0.1mdv2008.1.x86_64.rpm
71b324e15d4b58c4a5ab3aed3bbd0a99 2008.1/x86_64/dhcp-devel-3.0.7-0.1mdv2008.1.x86_64.rpm
a9c7b5638c446b507b87c0ac5cb4c8f4 2008.1/x86_64/dhcp-doc-3.0.7-0.1mdv2008.1.x86_64.rpm
8d8ef19b3ccbbc7525a600c1896575fa 2008.1/x86_64/dhcp-relay-3.0.7-0.1mdv2008.1.x86_64.rpm
8266ddf83f89615eba128653992f1d53 2008.1/x86_64/dhcp-server-3.0.7-0.1mdv2008.1.x86_64.rpm
a77a2457b18c1451351a76fdb7472c78 2008.1/SRPMS/dhcp-3.0.7-0.1mdv2008.1.src.rpm
Corporate 3.0:
54de19999bbf4b39ab3a9189dd5fa5fa corporate/3.0/i586/dhcp-client-3.0.7-0.1.C30mdk.i586.rpm
7b678eb4757dfcb400bbc4097ad60b78 corporate/3.0/i586/dhcp-common-3.0.7-0.1.C30mdk.i586.rpm
54b63fd21aa07368e2ffc56878bd58e8 corporate/3.0/i586/dhcp-devel-3.0.7-0.1.C30mdk.i586.rpm
031fec5d8ea648f653235d0bcc215914 corporate/3.0/i586/dhcp-relay-3.0.7-0.1.C30mdk.i586.rpm
fef3b9e4299b4a677a589b07d3bf6ac5 corporate/3.0/i586/dhcp-server-3.0.7-0.1.C30mdk.i586.rpm
72105849e3d42b6d83a65b310c05d6a6 corporate/3.0/SRPMS/dhcp-3.0.7-0.1.C30mdk.src.rpm
Corporate 3.0/X86_64:
2b10597ec3d80e8cb38e5a1b6b3f5b01 corporate/3.0/x86_64/dhcp-client-3.0.7-0.1.C30mdk.x86_64.rpm
81ff104ac3e7c3a8debb4f72a1dfafb4 corporate/3.0/x86_64/dhcp-common-3.0.7-0.1.C30mdk.x86_64.rpm
14a42d70ed2f1a4e7f267b1479d7eadf corporate/3.0/x86_64/dhcp-devel-3.0.7-0.1.C30mdk.x86_64.rpm
dfc169a8914abff0e70a15febfc3dfae corporate/3.0/x86_64/dhcp-relay-3.0.7-0.1.C30mdk.x86_64.rpm
4165cd0129634cdf83d456b3151263fc corporate/3.0/x86_64/dhcp-server-3.0.7-0.1.C30mdk.x86_64.rpm
72105849e3d42b6d83a65b310c05d6a6 corporate/3.0/SRPMS/dhcp-3.0.7-0.1.C30mdk.src.rpm
Corporate 4.0:
bc1ecfae06371e69e63fc8efc17f8e94 corporate/4.0/i586/dhcp-client-3.0.7-0.1.20060mlcs4.i586.rpm
6550db5984ae72454cfa9ad5592374fe corporate/4.0/i586/dhcp-common-3.0.7-0.1.20060mlcs4.i586.rpm
f9ab642c59ec5852cf55fe0745df76c1 corporate/4.0/i586/dhcp-devel-3.0.7-0.1.20060mlcs4.i586.rpm
3bf8441409e0f9af6969e28bce5ab306 corporate/4.0/i586/dhcp-relay-3.0.7-0.1.20060mlcs4.i586.rpm
a8cfab133de36ba8ccd5aa0e43695e2b corporate/4.0/i586/dhcp-server-3.0.7-0.1.20060mlcs4.i586.rpm
3fe6c892410037196e1d1b7e1e26d406 corporate/4.0/SRPMS/dhcp-3.0.7-0.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
1b9536b1c2b83aa3ccc1902e741326ae corporate/4.0/x86_64/dhcp-client-3.0.7-0.1.20060mlcs4.x86_64.rpm
d68e0b712210df499dcde1a03c046f56 corporate/4.0/x86_64/dhcp-common-3.0.7-0.1.20060mlcs4.x86_64.rpm
71797753f8f4ca74598060e437012d59 corporate/4.0/x86_64/dhcp-devel-3.0.7-0.1.20060mlcs4.x86_64.rpm
ec1ca4d3d07e5a73c8cdff3ff2ef8bc3 corporate/4.0/x86_64/dhcp-relay-3.0.7-0.1.20060mlcs4.x86_64.rpm
7eaacfb7e6960f9cf28a7961d7c2cbfe corporate/4.0/x86_64/dhcp-server-3.0.7-0.1.20060mlcs4.x86_64.rpm
3fe6c892410037196e1d1b7e1e26d406 corporate/4.0/SRPMS/dhcp-3.0.7-0.1.20060mlcs4.src.rpm
Multi Network Firewall 2.0:
c630bf4ca79dbd033df6088452026a61 mnf/2.0/i586/dhcp-client-3.0.7-0.1.C30mdk.i586.rpm
8672951e8a2c4eb635565effd354c58d mnf/2.0/i586/dhcp-common-3.0.7-0.1.C30mdk.i586.rpm
3588da06614ebd385af28c9b0bb6f3ed mnf/2.0/i586/dhcp-devel-3.0.7-0.1.C30mdk.i586.rpm
ccf7eb57ade14a72f6ba74860bff7b8f mnf/2.0/i586/dhcp-relay-3.0.7-0.1.C30mdk.i586.rpm
e14d98b9232460d191330a3262c91f4b mnf/2.0/i586/dhcp-server-3.0.7-0.1.C30mdk.i586.rpm
7387728a9235b4098fb7abd1c5583ca0 mnf/2.0/SRPMS/dhcp-3.0.7-0.1.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFKYLoqmqjQ0CJFipgRAqzNAKCafXD6d1xW+SJqatXc4Kf4+ZO5ygCgw0IG
9iXmSDm965VI614+3hfylN0=
=EEmD
-----END PGP SIGNATURE-----
