-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0607
                          dhcpcd security update
                               25 June 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           dhcpcd
Publisher:         Debian
Operating System:  Debian GNU/Linux 6
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Denial of Service               -- Remote/Unauthenticated
                   Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-2152  

Original Bulletin: 
   http://www.debian.org/security/2012/dsa-2498

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Debian. It is recommended that administrators 
         running dhcpcd check for an updated version of the software for 
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2498-1                   security@debian.org
http://www.debian.org/security/                         Yves-Alexis Perez
June 23, 2012                          http://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : dhcpcd
Vulnerability  : remote stack overflow
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2152
Debian Bug     : #671265

It was discovered that dhcpcd, a DHCP client, was vulnerable to a stack
overflow. A malformed DHCP message could crash the client, causing a denial of
service, and potentially remote code execution through properly designed
malicous DHCP packets.

For the stable distribution (squeeze), this problem has been fixed in
version 1:3.2.3-5+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 1:3.2.3-11.

For the unstable distribution (sid), this problem has been fixed in
version 1:3.2.3-11.

We recommend that you upgrade your dhcpcd package.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCgAGBQJP52AwAAoJEDBVD3hx7wuoCkcQANmkWRLHyxzRfYFcnYmv137e
1mTjyDavnytTXiRA1x3cDsS9kZMgO/NUFDfCP6tTVqB3tYnwFdP4pr8eaqj2CIQD
WLCVFd3BcGXeWni959gY5KEr/F7te5z1HawbZJrDzTv3jOUJB5mP5kfPpwN2Cx8F
Zv0DzO7lxb6ogbEzQOY8GV47CDQov8msBSPiaKSgTbamKh9i7FXvfOgDaY8xAB4+
GLAvgPzXe9Mvz6vVjt//pHlqOtJXBBn4IPf3ESJO2Pk9KEHlEInCxXUuak4w7kGn
yN4Ao40YwgpZDvN8HvXDeOwlAtYaZSFKXQT190aL+ZgVmBEGr+dhTDEoFkBrILXT
lB64mIEOaM+xrIlr03k0pdhGrldvnkYnmOAppRkhtK8di1ElidLMiGUrNGJ/jD9Y
YC28h3K/TVUY5veQaR9raGVu5/NOguDcwNbi+REB1ZYVVvB6Fd2FX1LJvqV06w/q
OJqr7OfyUb1rbxZQG1VD/tLKJQI9UmNovj910t9ne6Vjbv5rAt7WCmLSdKMjvhcR
B2Ke0ptetb8+wWpm295B7i03jtL6URm/ILxtwTbLzMIK7CRw2ABbuDjpE8uYL52V
9utjelsq29PqrWuf1KeawcPd3IK8FyTNIwj/wls8H+LiCfy78WOmUQmLsIeHU9G9
O59HjbsoUZzQ+RTkoTcx
=iUQH
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT+es6+4yVqjM2NGpAQI80w/+NJnOStpdm5HnZqYtWIwuQCiOTH5nh1nk
jyPzqta2+mxq0lR8XC7R0+pgPp5Uuc/pk0JvkRZkrIOlRsXCT6H11G/UnE0cMG7B
Sm3HG/8MPlI+O+qQVcdNZSyC8H9Z7Oq3YwTEqzyl0B2/3SAxCzxRHKB6n6pRu8Lw
It1N0Q/HdJ2vjzArpLKwjP4YGNfiszRSKQmn1i0Dwh/Jm4qHgpHv2aphomxnkMWg
0bzeHrjm8OansA1Z++BFRlIkVqQiEZMQ8jIFSKkBRXfJK8LCyOPX7mNHxalErauu
zZIytMIwj5i+JPM+WCBId6QLgYoUC/IykAhmM0EpLQHP3u2xYQWb8xX0VGRxlz8q
P+skhZSMwu/v86x4+W+WI0HbFCn1hrW8gxkblGY7jSC4jWUU99NK2QNPOsC4DO4o
1ksd44Cd7ngP7Fv+wA/fe0mcQAWkYQcgrerTmXpX67dYnATzW+NnlLky88H9sEzU
SpyCroYkatASO2LSIKzD9RCJ6j+K8/tBxDLdAi3khAAIH5h4N89O91AFpdSwMm5t
QLNFkLpbQgrkQcijKa9R6CHZrCL9yxYcwwlbyQDhRyauOE4taPTCFKu6vCqKuYCz
msOnZQQ2z0tCQVgeyHimtDrVImmt/EQc9elDKWHuExMpELr6TcEHsUVMB4Ng5X1r
zzBvG+Zk4J8=
=Crrt
-----END PGP SIGNATURE-----