Willem
Pinckaers reported to BUGTRAQ:
Introduction.
While browsing the bootpd source of version 2.4.3, shipped with
most recent unices, an overflow bug was found in the handling of
the boot file/location specified in a bootp request packet, and a
second bug exists in the error logging facility (which is only
available when running with a debug level bigger than 2). This bug
introduces a major security hole, including the possibility of
remote root access.
Vulnerable Systems.
All systems running bootpd 2.4.3.
All systems which are using a bootp daemon derived from the bootp
daemon originally released at Stanford University.
We don’t know of any unix system that is NOT vulnerable to this
problem.
Exploit code was tested against linux systems running debian 2.0
(glibc), and debian 1.3, both running bootpd 2.4.3.
————————— Technical information and exploit
removed.
Red Hat also ships bootp 2.4.3. Watch Linux Today for any
vendor updates as we receive them