Resource management error in dhcpcd - CVE-2014-6060
Published: September 4, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU41352
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-6060
CWE-ID: CWE-399
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DHO_OPTIONSOVERLOADED option in the (1) bootfile or (2) servername section, which triggers the option to be processed again.
Affected software
dhcpcd
Gentoo Linux
dhcpcd (Alpine package)
Gentoo Linux
dhcpcd (Alpine package)
How to mitigate CVE-2014-6060
Install update from vendor's website.
dhcpcd (Alpine package) - update to 5.6.2-r1
External References
- http://advisories.mageia.org/MGASA-2014-0334.html
- http://roy.marples.name/projects/dhcpcd/ci/1d2b93aa5ce25a8a710082fe2d36a6bf7f5794d5?sbs=0
- http://source.android.com/security/bulletin/2016-04-02.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:171
- http://www.openwall.com/lists/oss-security/2014/07/30/5
- http://www.openwall.com/lists/oss-security/2014/09/01/11
- http://www.securityfocus.com/bid/68970
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.462420