Executive brief
A critical vulnerability exists in bootpd, a service used to provide configuration and boot information to computers on a network. By sending a specially crafted request with an excessively long file path, an attacker can take complete control of the server. This could lead to a total system compromise, data theft, or the disruption of network booting services.
Technical details
A classic stack-based buffer overflow exists in the bootpd daemon (versions 2.4.3 and prior) during the handling of boot file location strings. The vulnerability is triggered when the service processes a BOOTP request containing an overly long path for the boot file, which exceeds the allocated buffer size without proper bounds checking. This is a remote, unauthenticated attack vector. Successful exploitation allows an attacker to overwrite the instruction pointer and execute arbitrary code with the privileges of the bootpd process, typically root. Organizations should update to a patched version or migrate to modern DHCP implementations.
Affected products
- bootpd 2.4.3 and earlier
Timeline
- 1997-06-01: disclosed: Initial publication date in NVD