Secunia

A vulnerability has been reported in OpenBSD, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

The vulnerability is caused due to the improper handling of DHCP requests within dhcpd in the "cons_options()" function in options.c. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted DHCP request specifying a maximum message size between DHCP_FIXED_LEN and DHCP_FIXED_LEN + 3.

Successful exploitation may allow the execution of arbitrary code.

Solution
Apply vendor patches.
Further details available in Customer Area

Provided and/or discovered by
Nahuel Riva and Gerardo Richarte, CORE IMPACT Exploit Writers Team

Changelog
Further details available in Customer Area

Original Advisory
Core Security Technologies:
http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1962

OpenBSD:
http://www.openbsd.org/errata40.html

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area