RHSA-2009:1154: Critical: dhcp security update

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allowsindividual devices on an IP network to get their own network configurationinformation, including an IP address, a subnet mask, and a broadcastaddress.The Mandriva Linux Engineering Team discovered a stack-based bufferoverflow flaw in the ISC DHCP client. If the DHCP client were to receive amalicious DHCP response, it could crash or execute arbitrary code with thepermissions of the client (root). (CVE-2009-0692)An insecure temporary file use flaw was discovered in the DHCP daemon'sinit script ("/etc/init.d/dhcpd"). A local attacker could use this flaw tooverwrite an arbitrary file with the output of the "dhcpd -t" command viaa symbolic link attack, if a system administrator executed the DHCP initscript with the "configtest", "restart", or "reload" option.(CVE-2009-1893)Users of DHCP should upgrade to these updated packages, which containbackported patches to correct these issues.