AndroidVulnerabilities.org

dhcpd buffer overrun

(json)

• CVE numbers: CVE-2014-7912 [dhcpd-fix], CVE-2014-7913 [dhcpd-fix]
• Coordinated disclosure?: true
• Categories: network
• Details: The specific flaw exists within the parsing of the DHCP options in a DHCP ACK packet. The vulnerability is triggered when the LENGTH of an option, when added to the current read position, exceeds the actual length of the DHCP options buffer. An attacker can leverage this vulnerability to execute code on the device. [ZDI-15-093] This remote code execution vulnerability executes code as the dhcp user which limit's its severity [citation-needed]
• Discovered by: Jüri Aedla [ZDI-15-093] on: 2014-11-13 [ZDI-15-093]
• Reported on: 2015-03-12 [ZDI-15-093]
• Fixed on: 2014-11-15 [dhcpd-fix]
• Fix released on: Unknown
• Affected versions: All versions below 5.1 [dhcpd-circl] regex: ([1-4].[0-9].[0-9])|(5.0.[0-9])
• Affected devices: all [dhcpd-circl]
• Affected manufacturers: all [dhcpd-circl]
• Fixed versions: 5.1 [dhcpd-circl]
• Submission: by: Laurent Simon, on: 2015-03-14; by: Daniel R. Thomas, on: 2015-03-24