5 - GLSA-200908-08

Executive Summary

Summary
Title	ISC DHCP: dhcpd Denial of Service

Informations
Name	GLSA-200908-08	First vendor Publication	2009-08-18
Vendor	Gentoo	Last vendor Modification	2009-08-18
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

dhcpd as included in the ISC DHCP implementation does not properly handle special conditions, leading to a Denial of Service.

Background

ISC DHCP is the reference implementation of the Dynamic Host Configuration Protocol as specified in RFC 2131.

Description

Christoph Biedl discovered that dhcpd does not properly handle certain DHCP requests when configured both using "dhcp-client-identifier" and
"hardware ethernet".

Impact

A remote attacker might send a specially crafted request to dhcpd, possibly resulting in a Denial of Service (daemon crash).

Workaround

There is no known workaround at this time.

Resolution

All ISC DHCP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose =net-misc/dhcp-3.1.2_p1

References

[ 1 ] CVE-2009-1892 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1892

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200908-08.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200908-08.xml

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-16	Configuration

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12854

Oval ID:	oval:org.mitre.oval:def:12854
Title:	DSA-1833-1 dhcp3 -- several
Description:	Several remote vulnerabilities have been discovered in ISC's DHCP implementation: It was discovered that dhclient does not properly handle overlong subnet mask options, leading to a stack-based buffer overflow and possible arbitrary code execution. Christoph Biedl discovered that the DHCP server may terminate when receiving certain well-formed DHCP requests, provided that the server configuration mixes host definitions using "dhcp-client-identifier" and "hardware ethernet". This vulnerability only affects the lenny versions of dhcp3-server and dhcp3-server-ldap. For the old stable distribution, these problems have been fixed in version 3.0.4-13+etch2. For the stable distribution, this problem has been fixed in version 3.1.1-6+lenny2. For the unstable distribution, these problems will be fixed soon. We recommend that you upgrade your dhcp3 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1833-1 CVE-2009-0692 CVE-2009-1892	Version:	5
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	dhcp3
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND hcp-client DPKG is earlier than 3.1.1-6+lenny2 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section hcp3-dev DPKG is earlier than 3.1.1-6+lenny2 AND hcp3-common DPKG is earlier than 3.1.1-6+lenny2 AND hcp3-client DPKG is earlier than 3.1.1-6+lenny2 AND hcp3-relay DPKG is earlier than 3.1.1-6+lenny2 AND hcp3-server-ldap DPKG is earlier than 3.1.1-6+lenny2 AND hcp3-server DPKG is earlier than 3.1.1-6+lenny2 OR Release section Debian GNU/Linux 4.0 is installed. AND Supported architectures section Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section hcp3-common DPKG is earlier than 3.0.4-13+etch2 AND hcp3-dev DPKG is earlier than 3.0.4-13+etch2 AND hcp3-client DPKG is earlier than 3.0.4-13+etch2 AND hcp3-relay DPKG is earlier than 3.0.4-13+etch2 AND hcp3-server DPKG is earlier than 3.0.4-13+etch2

Definition Id: oval:org.mitre.oval:def:13715

Oval ID:	oval:org.mitre.oval:def:13715
Title:	DSA-1833-2 dhcp3 -- several
Description:	The previous dhcp3 update did not properly apply the required changes to the stable version. The old stable version is not affected by this problem. The original advisory description follows. Several remote vulnerabilities have been discovered in ISC's DHCP implementation: It was discovered that dhclient does not properly handle overlong subnet mask options, leading to a stack-based buffer overflow and possible arbitrary code execution. Christoph Biedl discovered that the DHCP server may terminate when receiving certain well-formed DHCP requests, provided that the server configuration mixes host definitions using "dhcp-client-identifier" and "hardware ethernet". This vulnerability only affects the lenny versions of dhcp3-server and dhcp3-server-ldap. For the stable distribution, this problem has been fixed in version 3.1.1-6+lenny3. We recommend that you upgrade your dhcp3 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1833-2 CVE-2009-0692 CVE-2009-1892	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	dhcp3
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND hcp-client DPKG is earlier than 3.1.1-6+lenny3 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section hcp3-dev DPKG is earlier than 3.1.1-6+lenny3 AND hcp3-common DPKG is earlier than 3.1.1-6+lenny3 AND hcp3-client DPKG is earlier than 3.1.1-6+lenny3 AND hcp3-relay DPKG is earlier than 3.1.1-6+lenny3 AND hcp3-server-ldap DPKG is earlier than 3.1.1-6+lenny3 AND hcp3-server DPKG is earlier than 3.1.1-6+lenny3

Definition Id: oval:org.mitre.oval:def:8056

Oval ID:	oval:org.mitre.oval:def:8056
Title:	DSA-1833 dhcp3 -- several vulnerabilities
Description:	Several remote vulnerabilities have been discovered in ISC's DHCP implementation: It was discovered that dhclient does not properly handle overlong subnet mask options, leading to a stack-based buffer overflow and possible arbitrary code execution. Christoph Biedl discovered that the DHCP server may terminate when receiving certain well-formed DHCP requests, provided that the server configuration mixes host definitions using "dhcp-client-identifier" and "hardware ethernet". This vulnerability only affects the lenny versions of dhcp3-server and dhcp3-server-ldap.
Family:	unix	Class:	patch
Reference(s):	DSA-1833 CVE-2009-0692 CVE-2009-1892	Version:	3
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	dhcp3
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND dhcp-client is earlier than 3.1.1-6+lenny2 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section dhcp3-client is earlier than 3.1.1-6+lenny2 AND dhcp3-dev is earlier than 3.1.1-6+lenny2 AND dhcp3-relay is earlier than 3.1.1-6+lenny2 AND dhcp3-common is earlier than 3.1.1-6+lenny2 AND dhcp3-server-ldap is earlier than 3.1.1-6+lenny2 AND dhcp3-server is earlier than 3.1.1-6+lenny2 OR Release section Debian GNU/Linux 4.0 is installed. AND Supported architectures section Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section dhcp3-client is earlier than 3.0.4-13+etch2 AND dhcp3-common is earlier than 3.0.4-13+etch2 AND dhcp3-relay is earlier than 3.0.4-13+etch2 AND dhcp3-server is earlier than 3.0.4-13+etch2 AND dhcp3-dev is earlier than 3.0.4-13+etch2

CPE : Common Platform Enumeration

Type	Description	Count
Application	Isc Dhcp cpe:2.3:a:isc:dhcp:3.1.1:::::::* cpe:2.3:a:isc:dhcp:3.0.4_b3:::::::* cpe:2.3:a:isc:dhcp:3.0.4_b2:::::::* cpe:2.3:a:isc:dhcp:3.0.4_b1:::::::* cpe:2.3:a:isc:dhcp:3.0.4:::::::*	5

OpenVAS Exploits

Date	Description
2010-06-25	Name : Fedora Update for dhcp FEDORA-2010-10083 File : nvt/gb_fedora_2010_10083_dhcp_fc11.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:312 (dhcp) File : nvt/mdksa_2009_312.nasl
2009-11-17	Name : Fedora Core 11 FEDORA-2009-9075 (dhcp) File : nvt/fcore_2009_9075.nasl
2009-09-02	Name : Debian Security Advisory DSA 1833-2 (dhcp3) File : nvt/deb_1833_2.nasl
2009-09-02	Name : Fedora Core 10 FEDORA-2009-8344 (dhcp) File : nvt/fcore_2009_8344.nasl
2009-09-02	Name : Gentoo Security Advisory GLSA 200908-08 (dhcp) File : nvt/glsa_200908_08.nasl
2009-08-17	Name : Mandrake Security Advisory MDVSA-2009:172 (dhcp) File : nvt/mdksa_2009_172.nasl
2009-07-29	Name : Debian Security Advisory DSA 1833-1 (dhcp3) File : nvt/deb_1833_1.nasl
2009-07-29	Name : Mandrake Security Advisory MDVSA-2009:154 (dhcp) File : nvt/mdksa_2009_154.nasl
2009-07-29	Name : Ubuntu USN-805-1 (ruby1.9) File : nvt/ubuntu_805_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
56422	ISC DHCP dhcpd Unspecified Request Remote DoS

Nessus® Vulnerability Scanner

Date	Description
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1833.nasl - Type : ACT_GATHER_INFO
2009-12-04	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-312.nasl - Type : ACT_GATHER_INFO
2009-11-11	Name : The remote Fedora host is missing a security update. File : fedora_2009-9075.nasl - Type : ACT_GATHER_INFO
2009-08-26	Name : The remote Fedora host is missing a security update. File : fedora_2009-8344.nasl - Type : ACT_GATHER_INFO
2009-08-20	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200908-08.nasl - Type : ACT_GATHER_INFO
2009-07-20	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-154.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:36:39	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	3
CPE ID(s)	5
osvdb(s)	1
Openvas Exploit(s)	10
Nessus® Exploit(s)	6

	Related
5	CVE-2009-1892
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

5 - GLSA-200908-08

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU