Some vulnerabilities and a security issue have been reported in Dibbler, which can be exploited by malicious, local users to manipulate certain files and by malicious people to cause a DoS (Denial of Service).

1) Input validation errors when processing packets can be exploited to crash the service via specially crafted packets with e.g. options with large lengths, invalid lengths, or malformed IA_NA options in a REBIND message.

2) Files within the "/var/lib/dibbler" directory are created with world-writable permissions when "dibbler-server" or "dibbler-client" is started.

The vulnerabilities and the security issue are reported in version 0.6.0. Prior versions may also be affected.

Solution
Update to version 0.6.1 and ensure that file permissions in "/var/lib/dibbler" are set correctly.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Mu Security research team
2) Tero Pelander

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://labs.musecurity.com/wp-content/uploads/2007/09/mu-200709-02.txt

http://klub.com.pl/cgi-bin/bugzilla/show_bug.cgi?id=160

Deep Links
Links available to Secunia VIM customers