ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced.

The remote Solaris system is missing necessary patches to address security updates :

  - ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before     4.2.4-P2 allows remote attackers to cause a denial of     service (daemon crash) in opportunistic circumstances by     establishing an IPv6 lease in an environment where the     lease expiration time is later reduced. (CVE-2012-3955)

- Update to ISC dhcp-4.2.4-P2 release, providing a     security fix for an issue with the use of lease times     was found and fixed. Making certain changes to the end     time of an IPv6 lease could cause the server to abort.
    Thanks to Glen Eustace of Massey University, New Zealand     for finding this issue. ([ISC-Bugs #30281], CVE:
    CVE-2012-3955, bnc#780167)

A flaw was found in the way the dhcpd daemon handled the expiration time of IPv6 leases. If dhcpd's configuration was changed to reduce the default IPv6 lease time, lease renewal requests for previously assigned leases could cause dhcpd to crash. (CVE-2012-3955)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0504 advisory.

    - Reducing the expiration time for an IPv6 lease may cause the server to crash       (CVE-2012-3955, #858130)
    - An error in the handling of malformed client identifiers can       cause a denial-of-service condition in affected servers. (CVE-2012-3571, #843122)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated dhcp packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The dhcp packages provide the Dynamic Host Configuration Protocol (DHCP) that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.

A flaw was found in the way the dhcpd daemon handled the expiration time of IPv6 leases. If dhcpd's configuration was changed to reduce the default IPv6 lease time, lease renewal requests for previously assigned leases could cause dhcpd to crash. (CVE-2012-3955)

This update also fixes the following bugs :

* Prior to this update, the DHCP server discovered only the first IP address of a network interface if the network interface had more than one configured IP address. As a consequence, the DHCP server failed to restart if the server was configured to serve only a subnet of the following IP addresses. This update modifies network interface addresses discovery code to find all addresses of a network interface.
The DHCP server can also serve subnets of other addresses. (BZ#803540)

* Prior to this update, the dhclient rewrote the /etc/resolv.conf file with backup data after it was stopped even when the PEERDNS flag was set to 'no' before shut down if the configuration file was changed while the dhclient ran with PEERDNS=yes. This update removes the backing up and restoring functions for this configuration file from the dhclient-script. Now, the dhclient no longer rewrites the /etc/resolv.conf file when stopped. (BZ#824622)

All users of DHCP are advised to upgrade to these updated packages, which fix these issues. After installing this update, all DHCP servers will be restarted automatically.

A flaw was found in the way the dhcpd daemon handled the expiration time of IPv6 leases. If dhcpd's configuration was changed to reduce the default IPv6 lease time, lease renewal requests for previously assigned leases could cause dhcpd to crash. (CVE-2012-3955)

This update also fixes the following bugs :

  - Prior to this update, the DHCP server discovered only     the first IP address of a network interface if the     network interface had more than one configured IP     address. As a consequence, the DHCP server failed to     restart if the server was configured to serve only a     subnet of the following IP addresses. This update     modifies network interface addresses discovery code to     find all addresses of a network interface. The DHCP     server can also serve subnets of other addresses.

  - Prior to this update, the dhclient rewrote the     /etc/resolv.conf file with backup data after it was     stopped even when the PEERDNS flag was set to 'no'     before shut down if the configuration file was changed     while the dhclient ran with PEERDNS=yes. This update     removes the backing up and restoring functions for this     configuration file from the dhclient-script. Now, the     dhclient no longer rewrites the /etc/resolv.conf file     when stopped.

After installing this update, all DHCP servers will be restarted automatically.

This update to ISC dhcp-4.2.4-P2 release provides a security fix for an issue with the use of lease times. Making certain changes to the end time of an IPv6 lease could cause the server to abort. Thanks to Glen Eustace of Massey University, New Zealand for finding this issue.

CVE-2012-3955 has been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-201301-06 (ISC DHCP: Denial of Service)

    Multiple vulnerabilities have been discovered in ISC DHCP. Please review       the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities might allow remote attackers to execute arbitrary       code or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

A security issue was identified and fixed in dhcp :

ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced (CVE-2012-3955).

The updated packages have been patched to correct this issue.

This is security bugfix release fixing a security vulnerability.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Glen Eustace discovered that the ISC DHCP server, a server for automatic IP address assignment, is not properly handling changes in the expiration times of a lease. An attacker may use this flaw to crash the service and cause denial of service conditions, by reducing the expiration time of an active IPv6 lease.

Glen Eustace discovered that the DHCP server incorrectly handled IPv6 expiration times. A remote attacker could use this issue to cause DHCP to crash, resulting in a denial of service. This issue only affected Ubuntu 11.04, Ubuntu 11.10 and Ubuntu 12.04 LTS. (CVE-2012-3955)

Dan Rosenberg discovered that the DHCP AppArmor profile could be escaped by using environment variables. This update mitigates the issue by sanitizing certain variables in the DHCP shell scripts.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New dhcp packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix a security issue.

ID	Name	Product	Family	Severity
80648	Oracle Solaris Third-Party Patch Update : isc-dhcp (cve_2012_3955_denial_of)	Nessus	Solaris Local Security Checks	high
74765	openSUSE Security Update : dhcp (openSUSE-SU-2012:1252-1)	Nessus	SuSE Local Security Checks	high
74764	openSUSE Security Update : dhcp (openSUSE-SU-2012:1254-1)	Nessus	SuSE Local Security Checks	high
74763	openSUSE Security Update : dhcp (openSUSE-SU-2012:1234-1)	Nessus	SuSE Local Security Checks	high
69716	Amazon Linux AMI : dhcp (ALAS-2013-157)	Nessus	Amazon Linux Local Security Checks	high
68744	Oracle Linux 6 : dhcp (ELSA-2013-0504)	Nessus	Oracle Linux Local Security Checks	high
65139	CentOS 6 : dhcp (CESA-2013:0504)	Nessus	CentOS Local Security Checks	high
64949	Scientific Linux Security Update : dhcp on SL6.x i386/x86_64 (20130221)	Nessus	Scientific Linux Local Security Checks	high
64755	RHEL 6 : dhcp (RHSA-2013:0504)	Nessus	Red Hat Local Security Checks	high
64124	SuSE 11.2 Security Update : dhcp (SAT Patch Number 6831)	Nessus	SuSE Local Security Checks	high
63440	GLSA-201301-06 : ISC DHCP: Denial of Service	Nessus	Gentoo Local Security Checks	high
62402	Mandriva Linux Security Advisory : dhcp (MDVSA-2012:153-1)	Nessus	Mandriva Local Security Checks	high
62397	Fedora 16 : dhcp-4.2.4-1.P2.fc16 (2012-14076)	Nessus	Fedora Local Security Checks	high
62333	Fedora 17 : dhcp-4.2.4-13.P2.fc17 (2012-14149)	Nessus	Fedora Local Security Checks	high
62225	Debian DSA-2551-1 : isc-dhcp - denial of service	Nessus	Debian Local Security Checks	high
62180	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : dhcp3, isc-dhcp vulnerability (USN-1571-1)	Nessus	Ubuntu Local Security Checks	high
62167	Fedora 18 : dhcp-4.2.4-15.P2.fc18 (2012-13910)	Nessus	Fedora Local Security Checks	high
62102	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : dhcp (SSA:2012-258-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2012-3955

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high