CVE-2002-0702

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of ISC DHCP daemon (DHCPD) 3 to 3.0.1rc8, with the NSUPDATE option enabled, allow remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0063.html
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000483
http://marc.info/?l=bugtraq&m=102089498828206&w=2
http://www.cert.org/advisories/CA-2002-12.htmlPatch, Third Party Advisory, US Government Resource
http://www.iss.net/security_center/static/9039.phpPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/854315US Government Resource
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-037.phpPatch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2002_19_dhcp.html
http://www.securityfocus.com/bid/4701Patch, Vendor Advisory
http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0063.html
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000483
http://marc.info/?l=bugtraq&m=102089498828206&w=2
http://www.cert.org/advisories/CA-2002-12.htmlPatch, Third Party Advisory, US Government Resource
http://www.iss.net/security_center/static/9039.phpPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/854315US Government Resource
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-037.phpPatch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2002_19_dhcp.html
http://www.securityfocus.com/bid/4701Patch, Vendor Advisory

Timeline

Published: Jul 26, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-07037.5An interaction between the Perl MD5 module (perl-Digest-MD5) and Perl could produce incorrect MD5 checksums for UTF-8 data, which could prev CVE-2002-07047.5The Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier leaks translated IP addresses in ICMP error m CVE-2002-07057.5The Web Reports Server for SurfControl SuperScout WebFilter stores the "scwebusers" username and password file in a web-accessible directory CVE-2002-07067.5UserManager.js in the Web Reports Server for SurfControl SuperScout WebFilter uses weak encryption for administrator functions, which allows CVE-2002-07075.0The Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to cause a denial of service (CPU consumption) via large CVE-2002-07085.0Directory traversal vulnerability in the Web Reports Server for SurfControl SuperScout WebFilter allows remote attackers to read arbitrary f CVE-2002-07097.5SQL injection vulnerabilities in the Web Reports Server for SurfControl SuperScout WebFilter allow remote attackers to execute arbitrary SQL CVE-2002-07106.4Directory traversal vulnerability in sendform.cgi 1.44 and earlier allows remote attackers to read arbitrary files by specifying the desired CVE-2002-07115.0Unknown vulnerability in Cluster Interconnect for HP TruCluster Server 5.0A, 5.1, and 5.1A may allow local and remote attackers to cause a d CVE-2002-07122.1Entrust Authority Security Manager (EASM) 6.0 does not properly require multiple master users to change the password of a master user, which CVE-2002-07137.5Buffer overflows in Squid before 2.4.STABLE6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code CVE-2002-07147.5FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows re