dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-identifier and hardware ethernet configuration settings are both used, allows remote attackers to cause a denial of service (daemon crash) via unspecified requests.

Several remote vulnerabilities have been discovered in ISC's DHCP implementation :

  - CVE-2009-0692     It was discovered that dhclient does not properly handle     overlong subnet mask options, leading to a stack-based     buffer overflow and possible arbitrary code execution.

  - CVE-2009-1892     Christoph Biedl discovered that the DHCP server may     terminate when receiving certain well-formed DHCP     requests, provided that the server configuration mixes     host definitions using 'dhcp-client-identifier' and     'hardware ethernet'. This vulnerability only affects the     lenny versions of dhcp3-server and dhcp3-server-ldap.

A vulnerability has been found and corrected in ISC DHCP :

Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before 3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528; allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a malformed DHCP packet with a large dhcp-max-message-size that triggers a stack-based buffer overflow, related to servers configured to send many DHCP options to clients (CVE-2007-0062).

Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option (CVE-2009-0692).

ISC DHCP Server is vulnerable to a denial of service, caused by the improper handling of DHCP requests. If the host definitions are mixed using dhcp-client-identifier and hardware ethernet, a remote attacker could send specially crafted DHCP requests to cause the server to stop responding (CVE-2009-1892).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides fixes for this vulnerability.

Do not require policycoreutils when installing dhcp or dhclient packages. If you have the package installed, the /sbin/restorecon program will be used by dhclient-script and the dhcpd init script.
This update to the dhcp package includes fixes for CVE-2009-0692 and CVE-2009-1892. More information on these issues are available here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0692 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1892 Note:
CVE-2009-0692 had no security consequences on Fedora, thanks to the use of FORTIFY_SOURCE

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to the dhcp package includes fixes for CVE-2009-0692 and CVE-2009-1892. More information on these issues are available here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0692 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1892 Note:
CVE-2009-0692 had no security consequences on Fedora, thanks to the use of FORTIFY_SOURCE

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200908-08 (ISC DHCP: dhcpd Denial of Service)

    Christoph Biedl discovered that dhcpd does not properly handle certain     DHCP requests when configured both using 'dhcp-client-identifier' and     'hardware ethernet'.
  Impact :

    A remote attacker might send a specially crafted request to dhcpd,     possibly resulting in a Denial of Service (daemon crash).
  Workaround :

    There is no known workaround at this time.

A vulnerability has been found and corrected in ISC DHCP :

ISC DHCP Server is vulnerable to a denial of service, caused by the improper handling of DHCP requests. If the host definitions are mixed using dhcp-client-identifier and hardware ethernet, a remote attacker could send specially crafted DHCP requests to cause the server to stop responding (CVE-2009-1892).

This update provides fixes for this vulnerability.

ID	Name	Product	Family	Severity
44698	Debian DSA-1833-1 : dhcp3 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
42998	Mandriva Linux Security Advisory : dhcp (MDVSA-2009:312)	Nessus	Mandriva Local Security Checks	critical
42454	Fedora 11 : dhcp-4.1.0p1-4.fc11 (2009-9075)	Nessus	Fedora Local Security Checks	critical
40774	Fedora 10 : dhcp-4.0.0-37.fc10 (2009-8344)	Nessus	Fedora Local Security Checks	critical
40633	GLSA-200908-08 : ISC DHCP: dhcpd Denial of Service	Nessus	Gentoo Local Security Checks	medium
39873	Mandriva Linux Security Advisory : dhcp (MDVSA-2009:154)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2009-1892

high

Tenable Plugins

critical

critical

critical

critical

medium

medium