CVE-2009-0692

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-0692. PoCs published by Jon Oberheide.

AI-analyzed exploit summary This exploit targets a stack-based buffer overflow in ISC DHCP dhclient (CVE-2009-0692) by crafting a malicious DHCP response with an oversized subnet-mask option. It listens for DHCP requests and responds with a payload designed to overwrite the stack, leading to arbitrary code execution.

Description

Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Jon Oberheide · cdoslinux

https://www.exploit-db.com/exploits/9265

View Code ZIP pw:eip

This exploit targets a stack-based buffer overflow in ISC DHCP dhclient (CVE-2009-0692) by crafting a malicious DHCP response with an oversized subnet-mask option. It listens for DHCP requests and responds with a payload designed to overwrite the stack, leading to arbitrary code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: ISC DHCP dhclient < 3.1.2p1, 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0

No auth needed

Prerequisites: Network access to send crafted DHCP responses · Target must be requesting a DHCP lease

MITRE ATT&CK

T1189 - Drive-by Compromise T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (36)

Core 36

Core References

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/1891

Patch, Vendor Advisory x_refsource_confirm

https://www.isc.org/node/468

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35830

Issue Tracking x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=507717

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35832

Various Sources vendor-advisory x_refsource_hp

http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35850

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35785

US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/410676

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35880

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00003.html

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00340.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/40551

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/55819

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/35668

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2009/dsa-1833

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200907-12.xml

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2009:151

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2009-1136.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35831

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35829

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2010/1796

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35841

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5941

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10758

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/usn-803-1

Vendor Advisory vendor-advisory x_refsource_netbsd

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-010.txt.asc

Various Sources x_refsource_confirm

https://www.isc.org/downloadables/12

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2009-1154.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/37342

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35851

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35849

Vendor Advisory vendor-advisory x_refsource_slackware

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561471

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1022548

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36457

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01177.html

ISC DHCP <4.1.0p1-2.0 - Buffer Overflow

Exploitation Summary

Description

Exploits (1)

References (36)

Scores

Details