Overview
The Internet Software Consortium (ISC) has discovered several buffer overflow vulnerabilities in their implementation of DHCP (ISC DHCPD). These vulnerabilities may allow remote attackers to execute arbitrary code on affected systems. At this time, we are not aware of any exploits.
Description
There are multiple remote buffer overflow vulnerabilities in the ISC implementation of DHCP. As described in RFC 2131, "the Dynamic Host Configuration Protocol (DHCP) provides a framework for passing configuration information to hosts on a TCP/IP network." In addition to supplying hosts with network configuration data, ISC DHCPD allows the DHCP server to dynamically update a DNS server, obviating the need for manual updates to the name server configuration. Support for dynamic DNS updates is provided by the NSUPDATE feature. |
Impact
Remote attackers may be able to execute arbitrary code with the privileges of the user running ISC DHCPD. |
Solution
Upgrade or apply a patch |
Disable dynamic DNS updates (NSUPDATE) Block external access to DHCP server ports |
Vendor Information
BSDI Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Affected
Vendor Statement
This vulnerability is addressed by the M431-001 and M500-004 patches for the 4.3.1 and 5.0 versions of BSD/OS.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Conectiva Affected
Notified: November 26, 2002 Updated: January 28, 2003
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Conectiva has published Conectiva Linux Security Advisory CLSA-2003:562 to address this issue. For more information, please see
http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000562
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Debian Affected
Notified: November 26, 2002 Updated: January 20, 2003
Status
Affected
Vendor Statement
Debian has updated their distribution with DSA 231.
For the stable distribution (woody) this problem has been fixed in version 3.0+3.0.1rc9-2.1.
The old stable distribution (potato) does not contain dhcp3 packages.
For the unstable distribution (sid) this problem has been fixed in version 3.0+3.0.1rc11-1.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Debian Security Advisory DSA 231 is available at:
- http://www.debian.org/security/2003/dsa-231
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Gentoo Linux Affected
Notified: January 17, 2003 Updated: January 20, 2003
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Gentoo Linux has addressed this issue in Security Announcement 200301-10. For more details, see
http://forums.gentoo.org/viewtopic.php?t=30721
If you have feedback, comments, or additional information about this vulnerability, please send us email.
ISC Affected
Notified: November 16, 2002 Updated: January 15, 2003
Status
Affected
Vendor Statement
We have a patched version of 3.0 available (3.0pl2) and a new release candidate for the next bug-fix release (3.0.1RC11). Both of these new releases are available from http://www.isc.org/products/DHCP/.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
MandrakeSoft Affected
Notified: November 26, 2002 Updated: January 20, 2003
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
MandrakeSoft has address this vulnerability in Security Advisory MDKSA-2003:007, available at
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:007
If you have feedback, comments, or additional information about this vulnerability, please send us email.
OpenPKG Affected
Notified: January 16, 2003 Updated: January 20, 2003
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
OpenPKG has addressed this issue in Security Advisory OpenPKG-SA-2003.002, available at
http://www.openpkg.org/security/OpenPKG-SA-2003.002-dhcpd.html
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Red Hat Inc. Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Affected
Vendor Statement
Red Hat distributes a vulnerable version of ISC DHCP in Red Hat Linux 8.0. Other distributions of Red Hat Linux are not vulnerable to these issues. New DHCP packages are available along with our advisory at the URL below. Users of the Red Hat Network can update their systems using the 'up2date' tool.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Slackware Affected
Notified: January 19, 2003 Updated: January 21, 2003
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Slackware has addressed this issue by releasing new DHCP packages for Slackware 8.1 . For more information, please see
http://www.slackware.com/lists/archive/viewer.php?l=slackware-security&y=2003&m=slackware-security.198897
If you have feedback, comments, or additional information about this vulnerability, please send us email.
SuSE Inc. Affected
Notified: November 26, 2002 Updated: January 20, 2003
Status
Affected
Vendor Statement
We are preparing updates, that will be released soon.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
SuSE has addressed this issue in Security Announcement SuSE-SA:2003:0006, available at
http://www.suse.de/de/security/2003_006_dhcp.html
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Alcatel Not Affected
Notified: November 26, 2002 Updated: March 26, 2003
Status
Not Affected
Vendor Statement
Following CERT advisory CA-2003-01 on security vulnerabilities in the ISC DHCP implementation, Alcatel has conducted an immediate assessment to determine any impact this may have on our portfolio. A first analysis has shown that none of our products is impacted. The security of our customers' networks is of highest priority for Alcatel. Therefore we continue to test our product portfolio against potential ISC DHCP security vulnerabilities and will provide updates if necessary.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
This statement was provided by Alcatel on February 24, 2003.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Apple Computer Inc. Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
Mac OS X and Mac OS X Server do not contain the vulnerability described in this notice.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Cisco Systems Inc. Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
No Cisco products have been found to be affected by this vulnerability.
Several Cisco products do utilize the ISC DHCPD, however, no Cisco products implement the ISC DHCPD NSUPDATE feature, nor do they include the minires library.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Cray Inc. Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
Cray Inc. is not vulnerable as dhcpd is not supported on any of its products.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Fujitsu Not Affected
Notified: November 26, 2002 Updated: January 20, 2003
Status
Not Affected
Vendor Statement
Fujitsu's UXP/V OS is not vulnerable because it does not support the ISC DHCPD.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Hewlett-Packard Company Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
Source: Hewlett-Packard Company Software Security Response Team
cross reference id: SSRT2423
HP-UX - not vulnerable
HP-MPE/ix - not vulnerable
HP Tru64 UNIX - not vulnerable
HP OpenVMS - not vulnerable
HP NonStop Servers - not vulnerable
To report potential security vulnerabilities in HP software, send an E-mail message to: mailto:security-alert@hp.com
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Hitachi Not Affected
Notified: January 07, 2003 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
We've checked up on our router (Hitachi,Ltd. GR2000 series) about [VU#284857]. Our DHCP implementation is NOT vulnerable.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
IBM Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
IBM's AIX does not ship with the ISC DHCP daemon. The issues discussed in VU#284857 or any following advisories based on this vulnerability note do not pertain to AIX.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Ingrian Networks Not Affected
Notified: January 15, 2003 Updated: March 25, 2003
Status
Not Affected
Vendor Statement
Ingrian Networks products are not vulnerable to VU#284857.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Microsoft Corporation Not Affected
Notified: November 26, 2002 Updated: January 28, 2003
Status
Not Affected
Vendor Statement
Microsoft products do not use the libraries in question. Microsoft products are not affected by this vulnerability.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
MontaVista Software Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
None of MontaVista Software's Linux products are vulnerable to this issue.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
NEC Corporation Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
[Server Products]
* EWS/UP 48 Series operating system
- is NOT vulnerable.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
NetBSD Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
Currently supported versions of NetBSD do not contain the error handling routine vulnerabilities. Such vulnerabilities were fixed prior to the release of NetBSD 1.5.
With respect to the patch to ns_name.c, we believe that this is good defensive programming and have applied the patch to NetBSD-current. However, all calls to ns_name_ntol in the NetBSD source base pass a correct, constant, non-zero value as the datsiz parameter.
Therefore, NetBSD is not vulnerable.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
NetScreen Not Affected
Notified: January 08, 2003 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
NetScreen is not vulnerable to this issue.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
OpenBSD Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
OpenBSD's dhcp support is much modified, does not have that feature, and therefore does not have that bug.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Openwall GNU/*/Linux Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
Openwall GNU/*/Linux is not vulnerable. We don't yet provide a DHCP suite.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Riverstone Networks Not Affected
Notified: January 07, 2003 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
Riverstone Networks is not vulnerable to VU#284857.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Sun Microsystems Inc. Not Affected
Notified: November 26, 2002 Updated: January 15, 2003
Status
Not Affected
Vendor Statement
Sun confirms that we are not vulnerable to the issues described in VU#284857. Solaris does not ship the ISC DHCPD and does not use any of the ISC DHCPD source in its version of DHCPD.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Xerox Corporation Not Affected
Notified: November 26, 2002 Updated: March 26, 2003
Status
Not Affected
Vendor Statement
A response to this advisory is available from our web site: http://www.xerox.com/security.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
AT&T Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Avaya Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Computer Associates Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
D-Link Systems Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Data General Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
F5 Networks Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
FreeBSD Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Guardian Digital Inc. Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Intel Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Juniper Networks Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Lachman Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Lotus Software Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Lucent Technologies Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Multi-Tech Systems Inc. Unknown
Notified: January 15, 2003 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Network Appliance Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Nokia Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Nortel Networks Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Redback Networks Inc. Unknown
Notified: January 07, 2003 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
SGI Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Sequent Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Sony Corporation Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
The SCO Group (SCO Linux) Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
The SCO Group (SCO UnixWare) Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Unisys Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Wind River Systems Inc. Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Wirex Unknown
Notified: November 26, 2002 Updated: January 15, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
The CERT Coordination Center thanks David Hankins of the Internet Software Consortium for notifying us about this problem and for helping us to construct this document. We also thank Jacques A. Vidrine for drawing attention to this issue.
This document was written by Jeffrey P. Lanza.
Other Information
| CVE IDs: | CVE-2003-0026 |
| CERT Advisory: | CA-2003-01 |
| Severity Metric: | 5.27 |
| Date Public: | 2003-01-15 |
| Date First Published: | 2003-01-15 |
| Date Last Updated: | 2003-03-26 19:11 UTC |
| Document Revision: | 20 |