Advanced

DHCP server can take over client

Posted by Scott_Ruecker on · 6 comments
Heise		Mail this story
Print this story

Specially crafted DHCP servers can take control of a PC if the PC is running the DHCP client supplied by the Internet Systems Consortium (ISC) (dhclient). This is the default set-up in Ubuntu, BSD and many other Linux distributions. According to an ISC advisory, the vulnerability is based on a buffer overflow that allows attackers to inject arbitrary code into a system and execute it at root level. The buffer overflow can be triggered in the script_write_params method using excessively long server-supplied subnet masks.

Full Story

  Nav
» Read more about: Groups: Ubuntu, Linux; Story Type: News Story

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (6)

Sander_Marechal ·
The upstream security notice was published the 14th. I got the Debian updates yesterday (the 15th). Patched in a day. Nice :-)
bigg ·
Tuesday was Patch Tuesday. So a Windows user, at the earliest, would wait until August 11. And of course that assumes Microsoft actually fixes the problem right away.
jdixon ·
I installed the Slackware package this morning.
jacog ·
And usually FOSS security holes are discovered by the many eyes in the community, whereas Windows holes are usually discovered by malicious types.

Very important to note when your friendly neighbourhood Microsoft zealot comes croaking "ZOMG! I red on /. dat there r nother securty bug in LINSUX lol i pwn u n00bs" (yes yes, I am being rude)
Sander_Marechal ·
Quoting:Tuesday was Patch Tuesday. So a Windows user, at the earliest, would wait until August 11


Windows users are in luck. Windows is not affected by this.
bigg ·
> Windows is not affected by this.

But it demonstrates one of the differences. Windows definitely has security holes, and there's usually no urgency.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post