Vulnerability CVE-2014-7913

Vulnerability Name:

CVE-2014-7913 (CCN-105239)

Assigned:

2014-10-06

Published:

2015-03-12

Updated:

2017-09-21

Summary:

The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-119

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: Google Web site
Android

Source: MITRE
Type: CNA
CVE-2014-7913

Source: SECTRACK
Type: UNKNOWN
1033124

Source: CCN
Type: Google GIT Repository
Android

Source: CONFIRM
Type: UNKNOWN
https://android.googlesource.com/platform/external/dhcpcd/+/73c09dd8067250734511d955d8f792b41c7213f0

Source: XF
Type: UNKNOWN
google-android-cve20147913-code-exec(105239)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-7913

Vulnerable Configuration:

Configuration 1:

cpe:/a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:* (Version <= 6.9.0)

AND

cpe:/o:google:android:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:google:android:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.xenial:def:201479130000000	V	CVE-2014-7913 on Ubuntu 16.04 LTS (xenial) - medium.	2015-07-30
oval:com.ubuntu.bionic:def:201479130000000	V	CVE-2014-7913 on Ubuntu 18.04 LTS (bionic) - medium.	2015-07-29
oval:com.ubuntu.artful:def:20147913000	V	CVE-2014-7913 on Ubuntu 17.10 (artful) - medium.	2015-07-29
oval:com.ubuntu.trusty:def:20147913000	V	CVE-2014-7913 on Ubuntu 14.04 LTS (trusty) - medium.	2015-07-29
oval:com.ubuntu.bionic:def:20147913000	V	CVE-2014-7913 on Ubuntu 18.04 LTS (bionic) - medium.	2015-07-29
oval:com.ubuntu.xenial:def:20147913000	V	CVE-2014-7913 on Ubuntu 16.04 LTS (xenial) - medium.	2015-07-29
oval:com.ubuntu.cosmic:def:20147913000	V	CVE-2014-7913 on Ubuntu 18.10 (cosmic) - medium.	2015-07-29
oval:com.ubuntu.cosmic:def:201479130000000	V	CVE-2014-7913 on Ubuntu 18.10 (cosmic) - medium.	2015-07-29
oval:com.ubuntu.precise:def:20147913000	V	CVE-2014-7913 on Ubuntu 12.04 LTS (precise) - medium.	2015-07-29

BACK