CVE-2003-0039: Medium severity ISC dhcpd vulnerability

Published Feb 7, 2003

Updated

ISC dhcrelay (dhcp-relay) 3.0rc9 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (packet storm) via a certain BOOTP packet that is forwarded to a broadcast MAC address, causing an infinite loop that is not restricted by a hop count.

Affected Software

10 affected components

ISC dhcpd=3.0.1-rc9

ISC dhcpd=3.0.1-rc4

ISC dhcpd=3.0.1-rc5

ISC dhcpd=3.0.1-rc1

ISC dhcpd=3.0.1-rc10

ISC dhcpd=3.0.1-rc8

ISC dhcpd=3.0.1-rc3

ISC dhcpd=3.0.1-rc6

ISC dhcpd=3.0.1-rc2

ISC dhcpd=3.0.1-rc7

Remediation

Patch Available

http://www.debian.org/security/2003/dsa-245

Event History

Feb 7, 2003

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

RemedyDescriptionSeverityAffected Software

Sep 1, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2003-0039?

CVE-2003-0039 is classified as a denial of service vulnerability that can result in significant service disruption.

How do I fix CVE-2003-0039?

To fix CVE-2003-0039, it is recommended to upgrade to a later version of ISC dhcrelay that does not exhibit this vulnerability.

What are the affected versions in CVE-2003-0039?

The affected versions of ISC dhcrelay include 3.0.1-rc1 through 3.0.1-rc10.

What type of attack does CVE-2003-0039 involve?

CVE-2003-0039 involves an infinite loop caused by BOOTP packets forwarded to a broadcast MAC address, leading to a packet storm.

Who is impacted by CVE-2003-0039?

Any organization using ISC dhcrelay 3.0.1-rc1 to 3.0.1-rc10 is vulnerable to the denial of service conditions described in CVE-2003-0039.