Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.

This update of dhcp fixed multiple security vulnerabilities (memory leak, Denial of Service).

This update provides dhcp 4.2.4-p1, which fixes the dhcpv6 server crashing while accessing the lease on heap and provides the following additional fixes :

  - Security fixes :

  - Previously the server code was relaxed to allow packets     with zero length client ids to be processed. Under some     situations use of zero length client ids can cause the     server to go into an infinite loop. As such ids are not     valid according to RFC 2132 section 9.14 the server no     longer accepts them. Client ids with a length of 1 are     also invalid but the server still accepts them in order     to minimize disruption. The restriction will likely be     tightened in the future to disallow ids with a length of     1. (ISC-Bugs #29851, CVE-2012-3571)

  - When attempting to convert a DUID from a client id     option into a hardware address handle unexpected client     ids properly. (ISC-Bugs #29852, CVE-2012-3570)

  - A pair of memory leaks were found and fixed. (ISC-Bugs     #30024, (CVE-2012-3954) )

  - Further upstream fixes :

  - Moved lease file check to a separate action so it is not     used in restart -- it can fail when the daemon rewrites     the lease causing a restart failure then.

  - Request dhcp6.sntp-servers in /etc/dhclient6.conf and     forward to netconfig for processing.

  - Rotate the lease file when running in v6 mode. (ISC-Bugs     #24887)

  - Fixed the code that checks if an address the server is     planning to hand out is in a reserved range. This would     appear as the server being out of addresses in pools     with particular ranges. (ISC-Bugs #26498)

  - In the DDNS code handle error conditions more gracefully     and add more logging code. The major change is to handle     unexpected cancel events from the DNS client code.
    (ISC-Bugs #26287)

  - Tidy up the receive calls and eliminate the need for     found_pkt. (ISC-Bugs #25066)

  - Add support for Infiniband over sockets to the server     and relay code.

  - Modify the code that determines if an outstanding DDNS     request should be cancelled. This patch results in     cancelling the outstanding request less often. It fixes     the problem caused by a client doing a release where the     TXT and PTR records weren't removed from the DNS.
    (ISC-BUGS #27858)

  - Remove outdated note in the description of the bootp     keyword about the option not satisfying the requirement     of failover peers for denying dynamic bootp clients.
    (ISC-bugs #28574)

  - Multiple items to clean up IPv6 address processing. When     processing an IA that we've seen check to see if the     addresses are usable (not in use by somebody else)     before handing it out. When reading in leases from the     file discard expired addresses. When picking an address     for a client include the IA ID in addition to the client     ID to generally pick different addresses for different     IAs. (ISC-Bugs #23138, #27945, #25586, #27684)

  - Remove unnecessary checks in the lease query code and     clean up several compiler issues (some dereferences of     NULL and treating an int as a boolean). (ISC-Bugs     #26203)

  - Fix the NA and PD allocation code to handle the case     where a client provides a preference and the server     doesn't have any addresses or prefixes available.
    Previoulsy the server ignored the request with this     patch it replies with a NoAddrsAvail or NoPrefixAvail     response. By default the code performs according to the     errata of August 2010 for RFC 3315 section 17.2.2; to     enable the previous style see the section on     RFC3315_PRE_ERRATA_2010_08 in includes/site.h.

  - Fix up some issues found by static analysis. A potential     memory leak and NULL dereference in omapi. The use of a     boolean test instead of a bitwise test in dst. (ISC-Bugs     #28941)

In addition, the dhcp-server init script now checks the syntax prior restarting the daemon to avoid stopping of the daemon when a start would fail.

The remote host is affected by the vulnerability described in GLSA-201301-06 (ISC DHCP: Denial of Service)

    Multiple vulnerabilities have been discovered in ISC DHCP. Please review       the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities might allow remote attackers to execute arbitrary       code or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been discovered and corrected in ISC DHCP :

An unexpected client identifier parameter can cause the ISC DHCP daemon to segmentation fault when running in DHCPv6 mode, resulting in a denial of service to further client requests. In order to exploit this condition, an attacker must be able to send requests to the DHCP server (CVE-2012-3570).

An error in the handling of malformed client identifiers can cause a DHCP server running affected versions (see Impact) to enter a state where further client requests are not processed and the server process loops endlessly, consuming all available CPU cycles. Under normal circumstances this condition should not be triggered, but a non-conforming or malicious client could deliberately trigger it in a vulnerable server. In order to exploit this condition an attacker must be able to send requests to the DHCP server (CVE-2012-3571).

Two memory leaks have been found and fixed in ISC DHCP. Both are reproducible when running in DHCPv6 mode (with the -6 command-line argument.) The first leak is confirmed to only affect servers operating in DHCPv6 mode, but based on initial code analysis the second may theoretically affect DHCPv4 servers (though this has not been demonstrated.) (CVE-2012-3954).

The updated packages have been upgraded to the latest version (4.2.4-P1) which is not affected by these issues.

This is security bugfix release fixing several vulnerabilities.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ISC reports :

An unexpected client identifier parameter can cause the ISC DHCP daemon to segmentation fault when running in DHCPv6 mode, resulting in a denial of service to further client requests. In order to exploit this condition, an attacker must be able to send requests to the DHCP server.

An error in the handling of malformed client identifiers can cause a DHCP server running affected versions (see 'Impact') to enter a state where further client requests are not processed and the server process loops endlessly, consuming all available CPU cycles. Under normal circumstances this condition should not be triggered, but a non-conforming or malicious client could deliberately trigger it in a vulnerable server. In order to exploit this condition an attacker must be able to send requests to the DHCP server.

Two memory leaks have been found and fixed in ISC DHCP. Both are reproducible when running in DHCPv6 mode (with the -6 command-line argument.) The first leak is confirmed to only affect servers operating in DHCPv6 mode, but based on initial code analysis the second may theoretically affect DHCPv4 servers (though this has not been demonstrated.)

ID	Name	Product	Family	Severity
74718	openSUSE Security Update : dhcp (openSUSE-SU-2012:1006-1)	Nessus	SuSE Local Security Checks	medium
64122	SuSE 11.2 Security Update : dhcp (SAT Patch Number 6606)	Nessus	SuSE Local Security Checks	medium
63440	GLSA-201301-06 : ISC DHCP: Denial of Service	Nessus	Gentoo Local Security Checks	high
61967	Mandriva Linux Security Advisory : dhcp (MDVSA-2012:115)	Nessus	Mandriva Local Security Checks	medium
61442	Fedora 16 : dhcp-4.2.3-11.P2.fc16 (2012-11110)	Nessus	Fedora Local Security Checks	medium
61387	Fedora 17 : dhcp-4.2.4-9.P1.fc17 (2012-11079)	Nessus	Fedora Local Security Checks	medium
60115	FreeBSD : isc-dhcp -- multiple vulnerabilities (c7fa3618-d5ff-11e1-90a2-000c299b62e1)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-3570

high

Tenable Plugins

medium

medium

high

medium

medium

medium

medium