dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

The remote Solaris system is missing necessary patches to address security updates :

  - dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before     4.1-ESV-R4 does not properly handle regular expressions     in dhcpd.conf, which allows remote attackers to cause a     denial of service (daemon crash) via a crafted request     packet. (CVE-2011-4539)

Specially crafted requests could crash dhcpd if the server used regular expressions for matching (CVE-2011-4539).

- Updated to ISC dhcp-4.2.3-P2 release, providing a DDNS     security fix: Modify the DDNS handling code. In a     previous patch we added logging code to the DDNS     handling. This code included a bug that caused it to     attempt to dereference a NULL pointer and eventually     segfault. While reviewing the code as we addressed this     problem, we determined that some of the updates to the     lease structures would not work as planned since the     structures being updated were in the process of being     freed: these updates were removed. In addition we     removed an incorrect call to the DDNS removal function     that could cause a failure during the removal of DDNS     information from the DNS server. Thanks to Jasper     Jongmans for reporting this issue. ([ISC-Bugs #27078],     CVE: CVE-2011-4868, bnc#741239)

  - Removed obsolete dhcp-4.2.2-CVE-2011-4539-regex-DoS     patch.

- Applied security fix for a DoS due to processing certain     regular expressions, extracted from 4.2.3-P1     (bnc#735610, CVE-2011-4539) :

  - Add a check for a NULL pointer before calling the     regexec function. Without out this check we could, under     some circumstances, pass a NULL pointer to the regexec     function causing it to segfault. Thanks to a report from     BlueCat Networks. [ISC-Bugs #26704]

A denial of service flaw was found in the way the dhcpd daemon handled DHCP request packets when regular expression matching was used in '/etc/dhcp/dhcpd.conf'. A remote attacker could use this flaw to crash dhcpd. (CVE-2011-4539)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1819 advisory.

    [12:4.1.1-25.P1.1]
    - DoS due to processing certain regular expressions (CVE-2011-4539, #765682)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201301-06 (ISC DHCP: Denial of Service)

    Multiple vulnerabilities have been discovered in ISC DHCP. Please review       the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities might allow remote attackers to execute arbitrary       code or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

New dhcp packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues.

Several security vulnerabilities affecting ISC dhcpd, a server for automatic IP address assignment, have been discovered. Additionally, the latest security update for isc-dhcp, DSA-2516-1, did not properly apply the patches for CVE-2012-3571 and CVE-2012-3954. This has been addressed in this additional update.

  - CVE-2011-4539     BlueCat Networks discovered that it is possible to crash     DHCP servers configured to evaluate requests with     regular expressions via crafted DHCP request packets.

  - CVE-2012-3571     Markus Hietava of the Codenomicon CROSS project     discovered that it is possible to force the server to     enter an infinite loop via messages with malformed     client identifiers.

  - CVE-2012-3954     Glen Eustace discovered that DHCP servers running in     DHCPv6 mode and possibly DHCPv4 mode suffer of memory     leaks while processing messages. An attacker can use     this flaw to exhaust resources and perform denial of     service attacks.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.

A denial of service flaw was found in the way the dhcpd daemon handled DHCP request packets when regular expression matching was used in '/etc/dhcp/dhcpd.conf'. A remote attacker could use this flaw to crash dhcpd. (CVE-2011-4539)

Users of DHCP should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, all DHCP servers will be restarted automatically.

CVE-2011-4539 dhcpd: DoS due to processing certain regular expressions

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated dhcp packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.

A denial of service flaw was found in the way the dhcpd daemon handled DHCP request packets when regular expression matching was used in '/etc/dhcp/dhcpd.conf'. A remote attacker could use this flaw to crash dhcpd. (CVE-2011-4539)

Users of DHCP should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, all DHCP servers will be restarted automatically.

It was discovered that the DHCP server incorrectly handled certain malformed packets when configured to evaluate regular expressions. A remote attacker could use this issue to cause DHCP to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1819 advisory.

  - dhcp: DoS due to processing certain regular expressions (CVE-2011-4539)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability has been discovered and corrected in dhcp :

dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet (CVE-2011-4539).

The updated packages have been patched to correct this issue.

ISC reports :

A bug exists which allows an attacker who is able to send DHCP Request packets, either directly or through a relay, to remotely crash an ISC DHCP server if that server is configured to evaluate expressions using a regular expression (i.e. uses the '~=' or '~~' comparison operators).

ID	Name	Product	Family	Severity
80646	Oracle Solaris Third-Party Patch Update : isc-dhcp (cve_2011_4539_denial_of)	Nessus	Solaris Local Security Checks	medium
75815	openSUSE Security Update : dhcp (openSUSE-SU-2011:1318-1)	Nessus	SuSE Local Security Checks	medium
75467	openSUSE Security Update : dhcp (openSUSE-SU-2011:1318-1)	Nessus	SuSE Local Security Checks	medium
74786	openSUSE Security Update : dhcp (openSUSE-2012-71)	Nessus	SuSE Local Security Checks	medium
74532	openSUSE Security Update : dhcp (openSUSE-2011-68)	Nessus	SuSE Local Security Checks	medium
69638	Amazon Linux AMI : dhcp (ALAS-2012-31)	Nessus	Amazon Linux Local Security Checks	medium
68407	Oracle Linux 6 : dhcp (ELSA-2011-1819)	Nessus	Oracle Linux Local Security Checks	high
63440	GLSA-201301-06 : ISC DHCP: Denial of Service	Nessus	Gentoo Local Security Checks	high
61660	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : dhcp (SSA:2012-237-01)	Nessus	Slackware Local Security Checks	medium
61382	Debian DSA-2519-2 : isc-dhcp - several vulnerabilities	Nessus	Debian Local Security Checks	medium
61207	Scientific Linux Security Update : dhcp on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57418	Fedora 15 : dhcp-4.2.1-14.P1.fc15 (2011-16976)	Nessus	Fedora Local Security Checks	medium
57380	CentOS 6 : dhcp (CESA-2011:1819)	Nessus	CentOS Local Security Checks	medium
57321	Ubuntu 11.04 / 11.10 : isc-dhcp vulnerability (USN-1309-1)	Nessus	Ubuntu Local Security Checks	medium
57310	RHEL 6 : dhcp (RHSA-2011:1819)	Nessus	Red Hat Local Security Checks	high
57309	Fedora 16 : dhcp-4.2.3-4.P1.fc16 (2011-16981)	Nessus	Fedora Local Security Checks	medium
57052	Mandriva Linux Security Advisory : dhcp (MDVSA-2011:182)	Nessus	Mandriva Local Security Checks	medium
57045	FreeBSD : isc-dhcp-server -- Remote DoS (93be487e-211f-11e1-89b4-001ec9578670)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-4539

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

high

medium

medium

medium