SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2004-0460

Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via multiple hostname options in (1)…

HIGH 10.0EPSS 45.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 45.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via multiple hostname options in (1) DISCOVER, (2) OFFER, (3) REQUEST, (4) ACK, or (5) NAK messages, which can generate a long string when writing to a log file.

CVSS 2.0
10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
45.33% probability · 99th percentile
CISA KEV
Not listed
Affected
infoblox/dns one appliance · isc/dhcpd · suse/suse email server · suse/suse linux admin-cd for firewall · suse/suse linux connectivity server · suse/suse linux database server · suse/suse linux firewall cd · suse/suse linux office server · mandrakesoft/mandrake linux · redhat/fedora core · suse/suse linux
Source
cve@mitre.org

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.