CVE-2004-1006
highpriority · track · 43EPSS 0.080 · 95 %ileEUUSEPSS · scored 2026-10-27
Format string vulnerability in the log functions in dhcpd for dhcp 2.x allows remote DNS servers to execute arbitrary code via certain DNS messages, a different vulnerability than CVE-2002-0702.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedRed Hat Enterprise Linux AS (Advanced Server) version 2.1 redhat_csaf
Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2005:212 - FixedRed Hat Enterprise Linux ES version 2.1redhat_csaf
Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2005:212 - FixedRed Hat Linux Advanced Workstation 2.1redhat_csaf
Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2005:212
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (11)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux AS (Advanced Server) version 2.1 all versionsfixedredhat_csafUScpe:/o:redhat:enterprise_linux:2.1::as
- Red Hat Enterprise Linux ES version 2.1all versionsfixedredhat_csafUScpe:/o:redhat:enterprise_linux:2.1::es
- Red Hat Linux Advanced Workstation 2.1all versionsfixedredhat_csafUScpe:/o:redhat:enterprise_linux:2.1::aw
advisories (1)
Vendor and ecosystem advisories describing this.
- RHSA-2005:212Red Hat Security Advisory: dhcp security update2005-04-12csaf · redhat_csafUS
An updated dhcp package that fixes a string format issue is now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- http://archives.neohapsis.com/archives/bugtraq/2004-10/0287.htmlenisa_euvd
- http://archives.neohapsis.com/archives/bugtraq/2004-11/0037.htmlenisa_euvd
- http://marc.info/?l=bugtraq&m=109968710822449&w=2enisa_euvd
- http://www.debian.org/security/2004/dsa-584enisa_euvd
- http://www.kb.cert.org/vuls/id/448384enisa_euvd
- http://www.redhat.com/support/errata/RHSA-2005-212.htmlenisa_euvd
- http://www.securityfocus.com/bid/11591enisa_euvd
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17963enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan