Android_Vulnerabilities

Android Vulnerabilities

2015

dhcpd buffer overrun

CVE numbers: CVE-2014-7912 [dhcpd-fix], CVE-2014-7913 [dhcpd-fix]
Responsibly disclosed?: True
Categories: network
Details: The specific flaw exists within the parsing of the DHCP options in a DHCP ACK packet. The vulnerability is triggered when the LENGTH of an option, when added to the current read position, exceeds the actual length of the DHCP options buffer. An attacker can leverage this vulnerability to execute code on the device. [ZDI-15-093] This remote code execution vulnerability executes code as the dhcp user which limit's its severity [citation-needed]
Discovered by: Jüri Aedla [ZDI-15-093] on: 2014-11-13 [ZDI-15-093]
Reported on: 2015-03-12 [ZDI-15-093]
Fixed on: 2014-11-15 [dhcpd-fix]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers:
Fixed versions:
Submission: by: Laurent Simon, on: 2015-03-14; by: Blinded for review, on: 2015-03-24

Sothon

My name SOTHON HEM. I am studying IT at CMU, At here i had study alot about IT like: Windows Server 2012 (AD, DHCP, DNS, IIS, Share File and Permission), Server-U (FTP), Mail Server (Mdaemon). Red Hat Enterprise (DHCP, DNS, Samba, Apache). IT Audit, PHP, Java, VB, C++.etc. I also study CISO (CCNA2) at PPIC.

My job experience was as IT Support, IThelpDesk for two year. mostly what i do at work are: Fixed internet problem, Support end-user, Install application, Mail (outlook), Printer, scanner, Setup program, control stock devices,

What i interest in my Career is about IT Security. I always join IT Awareness work shop from SecuDemy. I used join CyberSeaGame in 2015, I join Online study at CSS which is base on IT Penetration Basic

NetSecKH