Signature Detail

DHCP: Bad Host Name Option

This anomaly triggers if it detects that the character in a DHCP Host Name is out of the valid range. This can indicate that your system is under attack.

Extended Description

ISC DHCPD is prone to a remotely exploitable buffer overflow vulnerability. This issue exists in routines responsible for logging hostname options provided by DHCP clients. Successful exploitation could result in execution of arbitrary code in the context of the DHCPD server. This issue is reported to affect ISC DHCPD versions 3.0.1rc12 and 3.0.1rc13. The vulnerable code exists in previous versions of ISC DHCPD 3, but is only believed to be exploitable in these two releases.

Affected Products

• Infoblox dns_one_appliance 2.3.1 -R5
• Infoblox dns_one_appliance 2.4.0 .0-8
• Infoblox dns_one_appliance 2.4.0 .0-8A
• Isc dhcpd 3.0.1 Rc12
• Isc dhcpd 3.0.1 Rc13
• Mandriva linux_mandrake 10.0.0
• Mandriva linux_mandrake 10.0.0 amd64
• Mandriva linux_mandrake 9.0.0
• Mandriva linux_mandrake 9.1.0
• Mandriva linux_mandrake 9.1.0 Ppc
• Mandriva linux_mandrake 9.2.0
• Mandriva linux_mandrake 9.2.0 amd64
• Red_hat fedora Core2
• Suse linux 8.0.0
• Suse linux 8.0.0 i386
• Suse linux 8.1.0
• Suse linux 9
• Suse linux 9.1
• Suse linux_admin-cd_for_firewall
• Suse linux_connectivity_server
• Suse linux_database_server
• Suse linux_firewall_on_cd
• Suse linux_office_server
• Suse linux_personal 8.2.0
• Suse linux_personal 9.0.0
• Suse linux_personal 9.0.0 X86 64
• Suse linux_personal 9.1.0
• Suse suse_email_server_iii
• Suse suse_linux_enterprise_server 7
• Suse suse_linux_enterprise_server 8

References

• BugTraq: 10590
• CVE: CVE-2004-0460
• CVE: CVE-2011-0997
• URL: ftp://ftp.rfc-editor.org/in-notes/rfc1035.txt