Read the docs
TI-2004-00912 Aliases CVE-2004-1006GHSA-3f5j-qwg9-83wr

Format string vulnerability in the log functions in dhcpd for dhcp 2.x allows remote DNS…

Priority MEDIUM 54Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Format string vulnerability in the log functions in dhcpd for dhcp 2.x allows remote DNS servers to execute arbitrary code via certain DNS messages, a different vulnerability than CVE-2002-0702.

Why it matters now

EPSS 0.07968 94th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:isc:dhcpd:2.0.pl5:*:*:*:*:*:*:*2.0.pl5VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0:*:*:*:*:*:*:*3.0VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0:rc12:*:*:*:*:*:*3.0 rc12VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0:rc4:*:*:*:*:*:*3.0 rc4VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc1:*:*:*:*:*:*3.0.1 rc1VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc10:*:*:*:*:*:*3.0.1 rc10VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc11:*:*:*:*:*:*3.0.1 rc11VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc12:*:*:*:*:*:*3.0.1 rc12VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc13:*:*:*:*:*:*3.0.1 rc13VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc14:*:*:*:*:*:*3.0.1 rc14VulnerableISC
  • cpe:2.3:a:isc:dhcpd:2.0.pl5:*:*:*:*:*:*:* Versions 2.0.pl5 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0:rc12:*:*:*:*:*:* Versions 3.0 rc12 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0:rc4:*:*:*:*:*:* Versions 3.0 rc4 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc1:*:*:*:*:*:* Versions 3.0.1 rc1 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc10:*:*:*:*:*:* Versions 3.0.1 rc10 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc11:*:*:*:*:*:* Versions 3.0.1 rc11 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc12:*:*:*:*:*:* Versions 3.0.1 rc12 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc13:*:*:*:*:*:* Versions 3.0.1 rc13 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc14:*:*:*:*:*:* Versions 3.0.1 rc14 Vulnerable ·ISC
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:isc:dhcpd:3.0.1:rc2:*:*:*:*:*:*3.0.1 rc2VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc3:*:*:*:*:*:*3.0.1 rc3VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc4:*:*:*:*:*:*3.0.1 rc4VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc5:*:*:*:*:*:*3.0.1 rc5VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc6:*:*:*:*:*:*3.0.1 rc6VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc7:*:*:*:*:*:*3.0.1 rc7VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc8:*:*:*:*:*:*3.0.1 rc8VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0.1:rc9:*:*:*:*:*:*3.0.1 rc9VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0_b2pl9:*:*:*:*:*:*:*3.0_b2pl9VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0_b2pl23:*:*:*:*:*:*:*3.0_b2pl23VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0_pl1:*:*:*:*:*:*:*3.0_pl1VulnerableISC
cpe:2.3:a:isc:dhcpd:3.0_pl2:*:*:*:*:*:*:*3.0_pl2VulnerableISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc2:*:*:*:*:*:* Versions 3.0.1 rc2 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc3:*:*:*:*:*:* Versions 3.0.1 rc3 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc4:*:*:*:*:*:* Versions 3.0.1 rc4 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc5:*:*:*:*:*:* Versions 3.0.1 rc5 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc6:*:*:*:*:*:* Versions 3.0.1 rc6 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc7:*:*:*:*:*:* Versions 3.0.1 rc7 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc8:*:*:*:*:*:* Versions 3.0.1 rc8 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0.1:rc9:*:*:*:*:*:* Versions 3.0.1 rc9 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0_b2pl9:*:*:*:*:*:*:* Versions 3.0_b2pl9 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0_b2pl23:*:*:*:*:*:*:* Versions 3.0_b2pl23 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0_pl1:*:*:*:*:*:*:* Versions 3.0_pl1 Vulnerable ·ISC
  • cpe:2.3:a:isc:dhcpd:3.0_pl2:*:*:*:*:*:*:* Versions 3.0_pl2 Vulnerable ·ISC

Remediation

Red Hat 1 advisory

  • RHSA-2005:212 Released 2005-04-12 · Red Hat rating Moderate
    dhcp security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Enterprise Linux ES version 2.1
    • Red Hat Linux Advanced Workstation 2.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2005:212
Red Hat Enterprise Linux ES version 2.1Fixed RHSA-2005:212
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2005:212

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-1006
  2. 2026-10-03 Alias added: GHSA-3f5j-qwg9-83wr

References

Patch 1

Advisory 2

Other 3

  • TI-2004-00415 Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP… CVSS 2.0HIGH 10.0
  • TI-2002-00679 Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of… CVSS 2.0HIGH 10.0
  • TI-2004-00416 The DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13, when compiled in… CVSS 2.0HIGH 10.0
  • TI-2003-00023 Multiple stack-based buffer overflows in the error handling routines of the minires… CVSS 2.0HIGH 7.5
  • TI-2019-04534 dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries CVSS 3.1HIGH 7.5
  • TI-2003-00035 ISC dhcrelay (dhcp-relay) 3.0rc9 and earlier, and possibly other versions, allows remote… CVSS 2.0MEDIUM 5.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences