Description
Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | dhcp | 1:2.0pl5-11 | RHSA-2007:0970 |
Advisories 1
- RHSA-2007:0970 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list
- 25729 vdb-entry
- GLSA-200711-23 vendor-advisory
- USN-543-1 vendor-advisory
- dhcp-param-underflow(33103) vdb-entry
- 1018717 vdb-entry
- ADV-2007-3229 vdb-entry
- 27694 third-party-advisory
- 20070919 VMWare DHCP Server Remote Code Execution Vulnerabilities third-party-advisory
- http://www.vmware.com/support/server/doc/releasenotes_server.html
- http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
- http://www.vmware.com/support/player2/doc/releasenotes_player2.html
- 26890 third-party-advisory
- http://www.vmware.com/support/ace/doc/releasenotes_ace.html
- http://www.vmware.com/support/player/doc/releasenotes_player.html
- http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
- 27706 third-party-advisory
- http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html