Vulnerability in dhcpcd5 - Arbitrary Code Execution and Denial of Service
Summary
DLA-506-1: dhcpcd5 - security update. Affects dhcpcd5 versions < 5.5.6-1+deb7u2. Fixed in 5.5.6-1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dhcpcd5 is a DHCP client package used for automatically configuring network interfaces. It is commonly used in Debian 7 (Wheezy) systems. This package allows devices to obtain IP addresses and other network configuration information from DHCP servers. However, two vulnerabilities have been discovered in dhcpcd5 that could potentially be exploited by remote attackers on a local network.
Vulnerability Detail
The first vulnerability, identified as CVE-2014-7912, is due to the get_option function in dhcpcd5 not properly validating the relationship between length fields and the amount of data. This flaw allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) by sending a DHCPACK message with a large length value for an option.
The second vulnerability, known as CVE-2014-7913, stems from the print_option function misinterpreting the return value of the snprintf function. This misinterpretation enables remote DHCP servers to execute arbitrary code or trigger a denial of service (memory corruption) by sending a crafted message.
Both vulnerabilities pose a significant risk as they can lead to the execution of arbitrary code or cause a denial of service attack on affected systems.
How To Fix
Minimum fixed version
5.5.6-1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dhcpcd5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerabilities in dhcpcd5 can be mitigated by upgrading the package to version 5.5.6-1+deb7u2 or later. It is crucial to promptly apply the recommended fix to prevent potential exploitation. For further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dhcpcd5 →
FAQ
dhcpcd5 is a DHCP client package used for automatically configuring network interfaces in Debian 7 (Wheezy) systems.
The vulnerabilities can allow remote attackers to execute arbitrary code or cause a denial of service attack on affected systems.
To fix these vulnerabilities, upgrade the dhcpcd5 package to version 5.5.6-1+deb7u2 or later.
No specific workarounds have been provided for these vulnerabilities.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for dhcpcd5.
