CVE-2011-2749
At a glance
- Source
- NVD
- EPSS
- EPSS 38.77 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
- http://www.ubuntu.com/usn/USN-1190-1
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065176.html
- http://secunia.com/advisories/45595
- http://lists.opensuse.org/opensuse-updates/2011-09/msg00014.html
- http://www.debian.org/security/2011/dsa-2292
- http://www.redhat.com/support/errata/RHSA-2011-1160.html
- http://securitytracker.com/id?1025918
- http://secunia.com/advisories/45817
- http://www.securityfocus.com/bid/49120
- http://www.isc.org/files/release-notes/DHCP%204.1-ESV-R3.html
- http://www.isc.org/files/release-notes/DHCP%203.1-ESV-R3_0.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://secunia.com/advisories/45582
- https://bugzilla.redhat.com/attachment.cgi?id=517665&action=diff
- http://secunia.com/advisories/45918
- http://www.isc.org/software/dhcp/advisories/cve-2011-2748
- http://security.gentoo.org/glsa/glsa-201301-06.xml
- http://www.isc.org/files/release-notes/DHCP%204.2.2_0.html
- http://secunia.com/advisories/45639
- https://bugzilla.redhat.com/show_bug.cgi?id=729382
- http://secunia.com/advisories/45629
- https://hermes.opensuse.org/messages/11695711
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:128
- http://secunia.com/advisories/46780
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2011-2724
- GCVE · GCVE-0-2011-2749
CERT-FR advisories
- CERTFR-2016-AVI-344 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2011-AVI-452 — Vulnérabilités dans ISC DHCP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:isc:dhcp:3.0:*:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:-:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc10:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc11:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc12:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc13:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc14:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc2:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc5:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc6:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc7:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc8:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.1:rc9:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.2:-:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.2:b1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.2:rc1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.2:rc2:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.2:rc3:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.3:b1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.3:b2:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.3:b3:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.4:-:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.4:b1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.4:b2:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.4:b3:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.4:rc1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.5:-:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.5:rc1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.0.6:rc1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1:*:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1-esv:*:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1.0:-:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1.0:a1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1.0:a2:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1.0:a3:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1.0:b1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1.0:b2:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1.0:rc1:*:*:*:*:*:*cpe:2.3:a:isc:dhcp:3.1.1:-:*:*:*:*:*:*- +52 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |