Debian: dhcp format string vulnerability fix

    Date04 Nov 2004
    CategoryDebian
    2298
    Posted ByLinuxSecurity Advisories
    "infamous41md" noticed that the log functions in dhcp 2.x, which is still distributed in the stable Debian release, contained pass parameters to function that use format strings. One use seems to be exploitable in connection with a malicious DNS server.
    
    --------------------------------------------------------------------------
    Debian Security Advisory DSA 584-1                     This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                             Martin Schulze
    November 4th, 2004                       http://www.debian.org/security/faq
    --------------------------------------------------------------------------
    
    Package        : dhcp
    Vulnerability  : format string vulnerability
    Problem-Type   : remote
    Debian-specific: no
    CVE ID         : CAN-2004-1006
    
    "infamous41md" noticed that the log functions in dhcp 2.x, which is
    still distributed in the stable Debian release, contained pass
    parameters to function that use format strings.  One use seems to be
    exploitable in connection with a malicious DNS server.
    
    For the stable distribution (woody) these problems have been fixed in
    version 2.0pl5-11woody1.
    
    For the unstable distribution (sid) these problems have been fixed in
    version 2.0pl5-19.1.
    
    We recommend that you upgrade your dhcp package.
    
    
    Upgrade Instructions
    --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 3.0 alias woody
    --------------------------------
    
      Source archives:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1.dsc
          Size/MD5 checksum:      683 9fbc12c28d4c973fc85157331c26aae5
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1.diff.gz
          Size/MD5 checksum:    48678 11af0bf9045654e302da7704d856ead4
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5.orig.tar.gz
          Size/MD5 checksum:   294909 ab22f363a7aff924e2cc9d1019a21498
    
      Alpha architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_alpha.deb
          Size/MD5 checksum:   230656 6c7c2c912063527503ca64b59e3a58ac
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_alpha.deb
          Size/MD5 checksum:   215658 24dabab111aec962caacf5a793d15338
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_alpha.deb
          Size/MD5 checksum:   159940 a447290821e3737d567c5949f7ca9966
    
      ARM architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_arm.deb
          Size/MD5 checksum:   211188 636b1709fbb6cea278b4248130e320c0
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_arm.deb
          Size/MD5 checksum:   198582 e0efe5b93e0ecbc34caec0c7a15c9700
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_arm.deb
          Size/MD5 checksum:   148746 0ce691f9f921277d9b526161921999c3
    
      Intel IA-32 architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_i386.deb
          Size/MD5 checksum:   204550 9dd0affebf04890280d57cc27221d12c
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_i386.deb
          Size/MD5 checksum:   192092 8f70ab57e89a22dd7b9ce5c1d9f51a35
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_i386.deb
          Size/MD5 checksum:   144962 c03163e469f7477f4479d2400a16ea5e
    
      Intel IA-64 architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_ia64.deb
          Size/MD5 checksum:   295214 483b1ad144c76ac994c3db46d0dce32f
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_ia64.deb
          Size/MD5 checksum:   277702 31597876b5623a7d1b24b28db3fc4e55
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_ia64.deb
          Size/MD5 checksum:   197380 00747f82e74e9b8856b9676d9c14124f
    
      HP Precision architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_hppa.deb
          Size/MD5 checksum:   209292 317aeeacb930a39d7d2dc5e59c532f3a
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_hppa.deb
          Size/MD5 checksum:   197714 4ba10395c93aae31d4c27fa193964a65
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_hppa.deb
          Size/MD5 checksum:   149114 322771b83583570cd6f350ba6a1e4b0f
    
      Motorola 680x0 architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_m68k.deb
          Size/MD5 checksum:   200208 c931a802045b2be93488bd45b6dc4eed
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_m68k.deb
          Size/MD5 checksum:   188024 d25022b06425b4717d7e884fe44403d2
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_m68k.deb
          Size/MD5 checksum:   143126 dd38b9e0ea2ecd5455e3c506e259d41a
    
      Big endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_mips.deb
          Size/MD5 checksum:   217844 fa15e8387bb50f9011f8bda8110bc0e6
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_mips.deb
          Size/MD5 checksum:   205468 36b92f32880cc70bb1ce7277f393df0e
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_mips.deb
          Size/MD5 checksum:   154020 cb8cd4947dbfc2b65991095e8a35c36f
    
      Little endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_mipsel.deb
          Size/MD5 checksum:   217290 67f7e6c6d879b533936f70711ee48c4c
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_mipsel.deb
          Size/MD5 checksum:   204742 5c654f6cb04582739fc3aa445a865243
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_mipsel.deb
          Size/MD5 checksum:   153376 0672d189292961527c0d06b14db6f781
    
      PowerPC architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_powerpc.deb
          Size/MD5 checksum:   205052 fe96048ef94b2a8b99fa54539b0455b5
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_powerpc.deb
          Size/MD5 checksum:   192580 94c021c9da018495aa462d27e3078bb1
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_powerpc.deb
          Size/MD5 checksum:   145924 2a95b2aad76a2578e7ade66f65e39f33
    
      IBM S/390 architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_s390.deb
          Size/MD5 checksum:   207858 8770a183836bc33dd38f78375b47dca7
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_s390.deb
          Size/MD5 checksum:   195460 c7ea6dfb54bad5e2855f774cdc40cb8d
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_s390.deb
          Size/MD5 checksum:   148234 b6b2b6feb6477ad485c9f5a3145c9da1
    
      Sun Sparc architecture:
    
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-11woody1_sparc.deb
          Size/MD5 checksum:   212454 185e57de8c23336e25b50251e42ea317
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-11woody1_sparc.deb
          Size/MD5 checksum:   200980 4f8eadd993129822ebc700348d10f7d8
         http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-11woody1_sparc.deb
          Size/MD5 checksum:   153904 8cb3d4a775bedaf06bdbaea21f765448
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    ---------------------------------------------------------------------------------
    For apt-get: deb  http://security.debian.org/ stable/updates main
    For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  http://packages.debian.org/
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"5","type":"x","order":"1","pct":55.56,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":33.33,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":11.11,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.