CVE-2004-0460 Memory corruption in n/a

Critical 10.0 Published 24 Jun 2004 Updated 8 Aug 2024

Remote attackers can crash the DHCP server or execute arbitrary code via buffer overflow in logging when processing multiple hostname options.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2004-0460?

CVE-2004-0460 is a critical memory corruption vulnerability in Mandrakesoft Mandrake Linux, published on 24 Jun 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via multiple hostname options in (1) DISCOVER, (2) OFFER, (3) REQUEST, (4) ACK, or (5) NAK messages, which can generate a long string when writing to a log file.

Which versions are affected by CVE-2004-0460?

It affects 11 products.

Products include Infoblox Dns One Appliance, Isc Dhcpd, Mandrakesoft Mandrake Linux, Redhat Fedora Core, Suse Suse Email Server, Suse Suse Linux and 5 more.

How do I fix CVE-2004-0460?

No fix has been published for CVE-2004-0460 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2004-0460 being exploited?

There is no known exploitation of CVE-2004-0460 in the wild and no public exploit code.

All Mandrakesoft Mandrake Linux vulnerabilities

Sources

Also known as GHSA-qhjw-939w-vp4h.