TUCoPS :: Unix :: General :: ca200212.txt

-----BEGIN PGP SIGNED MESSAGE-----
CERT Advisory CA-2002-12 Format String Vulnerability in ISC DHCPD
 Original release date: May 8, 2002
 Last revised:--
 Source: CERT/CC
 A complete revision history can be found at the end of this file.
Systems Affected
 * ISC DHCPD 3.0 to 3.0.1rc8 inclusive
Overview
 The Internet Software Consortium (ISC) provides a Dynamic Host
 Configuration Protocol Daemon (DHCPD), which is a server that is used
 to allocate network addresses and assign configuration parameters to
 hosts. A format string vulnerability may permit a remote attacker to
 execute code with the privileges of the DHCPD (typically root). We
 have not seen active scanning or exploitation of this vulnerability.
I. Description
 ISC's DHCPD listens for requests from client machines connecting to
 the network. Versions 3 to 3.0.1rc8 (inclusive) of DHCPD contains an
 option (NSUPDATE) that is enabled by default. NSUPDATE allows the DHCP
 server to send information about the host to the DNS server after
 processing a DHCP request. The DNS server responds by sending an
 acknowledgement message back to the DHCP server that may contain
 user-supplied data (like a host name). When the DHCP server receives
 the acknowledgement message from the DNS server, it logs the
 transaction.
 A format string vulnerability exists in ISC's DHCPD code that logs the
 transaction. This vulnerability may permit a remote attacker to
 execute code with the privileges of the DHCP daemon.
II. Impact
 A remote attacker may be able to execute code with the privileges of
 the DHCPD (typically root).
III. Solution
 Note that some of the mitigation steps recommended below may have
 significant impact on your normal network operations. Ensure that any
 changes made based on the following recommendations will not
 unacceptably affect any of your operations.
Apply a patch from your vendor
 Appendix A contains information provided by vendors for this advisory.
Disable the DHCP service
 As a general rule, the CERT/CC recommends disabling any service or
 capability that is not explicitly required. Depending on your network
 configuration, you may not need to use DHCP.
Ingress filtering
 As a temporary measure, it may be possible to limit the scope of this
 vulnerability by blocking access to DHCP services at the network
 perimeter.
 Ingress filtering manages the flow of traffic as it enters a network
 under your administrative control. In the network usage policy of many
 sites, there are few reasons for external hosts to initiate inbound
 traffic to machines that provide no public services. Thus, ingress
 filtering should be performed at the border to prohibit externally
 initiated inbound traffic to non-authorized services. For DHCP,
 ingress filtering of the following ports can prevent attackers outside
 of your network from reaching vulnerable devices in the local network
 that are not explicitly authorized to provide public DHCP services.
 bootps 67/tcp # Bootstrap Protocol Server
 bootps 67/udp # Bootstrap Protocol Server
 bootpc 68/tcp # Bootstrap Protocol Client
 bootpc 68/udp # Bootstrap Protocol Client
Appendix A. - Vendor Information
 This appendix contains information provided by vendors for this
 advisory. As vendors report new information to the CERT/CC, we will
 update this section and note the changes in our revision history. If a
 particular vendor is not listed below, please check the Vulnerability
 Note (VU#854315) or contact your vendor directly.
Alcatel
 The security of our customers' networks is of highest priority for
 Alcatel. Alcatel is aware of this security issue in the DHCP
 implementation of ISC and has put measures in place to assess which
 of its products might be affected and to apply the necessary fixes
 where required. An update will be shortly published to provide more
 details on any affected products.
Conectiva
 Conectiva Linux 8 ships dhcp-3.0 and is vulnerable to this problem.
 Updates will be available at our ftp site and an announcement will
 be sent to our mailing lists as soon as CERT publishes its
 advisory.
F5 Networks, Inc.
 F5 Networks' products do not include any affected version of ISC's
 DHCPD, and are therefore not vulnerable.
FreeBSD
 The FreeBSD base system does not ship with the ISC dhcpd server by
 default and is not affected by this vulnerability. The ISC dhcpd
 server is available in the FreeBSD Ports Collection; updates to the
 ISC dhcp port (ports/net/isc-dhcp3) are in progress and corrected
 packages will be available in the near future.
IBM
 IBM's AIX operating system, all versions, is not vulnerable.
Internet Software Consortium
 A patch is included below, and we have a patched version of 3.0
 available (3.0pl1) and a new release candidate for the next bug-fix
 release (3.0.1RC9). Both of these new releases are not vulnerable.
 --- common/print.c Tue Apr 9 13:41:17 2002
 +++ common/print.c.patched Tue Apr 9 13:41:56 2002
 @@ -1366,8 +1366,8 @@
 *s++ = '.';
 *s++ = 0;
 if (errorp)
 - log_error (obuf);
 + log_error ("%s",obuf);
 else
 - log_info (obuf);
 + log_info ("%s",obuf);
 }
 #endif /* NSUPDATE */
 
Lotus Development Corporation
 This issue does not affect Lotus products.
Microsoft Corporation
 Microsoft does not ship the ISC DHCPD program.
NetBSD
 NetBSD fixed this during a format string sweep performed on
 11-Oct-2000. No released version of NetBSD is vulnerable to this
 issue.
Silicon Graphics, Inc.
 SGI is not vulnerable.
 _________________________________________________________________
 The CERT Coordination Center acknowledges Next Generation Security
 Technologies as the discoverer of this vulnerability and thanks them
 and the Internet Software Consortium (ISC) for their cooperation,
 reporting, and analysis of this vulnerability.
 _________________________________________________________________
 Feedback can be directed to the author: Ian A. Finlay
 ______________________________________________________________________
 This document is available from:
 http://www.cert.org/advisories/CA-2002-12.html
______________________________________________________________________
CERT/CC Contact Information
 Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
 Fax: +1 412-268-6989
 Postal address:
 CERT Coordination Center
 Software Engineering Institute
 Carnegie Mellon University
 Pittsburgh PA 15213-3890
 U.S.A.
 CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) /
 EDT(GMT-4) Monday through Friday; they are on call for emergencies
 during other hours, on U.S. holidays, and on weekends.
Using encryption
 We strongly urge you to encrypt sensitive information sent by email.
 Our public PGP key is available from
 http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
 information.
Getting security information
 CERT publications and other security information are available from
 our web site
 http://www.cert.org/
To subscribe to the CERT mailing list for advisories and bulletins,
 send email to majordomo@cert.org. Please include in the body of your
 message
 subscribe cert-advisory
 * "CERT" and "CERT Coordination Center" are registered in the U.S.
 Patent and Trademark Office.
 ______________________________________________________________________
 NO WARRANTY
 Any material furnished by Carnegie Mellon University and the Software
 Engineering Institute is furnished on an "as is" basis. Carnegie
 Mellon University makes no warranties of any kind, either expressed or
 implied as to any matter including, but not limited to, warranty of
 fitness for a particular purpose or merchantability, exclusivity or
 results obtained from use of the material. Carnegie Mellon University
 does not make any warranty of any kind with respect to freedom from
 patent, trademark, or copyright infringement.
 _________________________________________________________________
 Conditions for use, disclaimers, and sponsorship information
 Copyright 2002 Carnegie Mellon University.
 Revision History
May 8, 2002: Initial release
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
iQCVAwUBPNle2qCVPMXQI2HJAQEJ5gP/SKXwgQG1Z4Y+dQmAqGnHxYEZuKaPDuLB
zLmkVcPQrpdo8DVDNpy3uMK1Mfro3RFLMg5mTON4noHiiIQb5M7iZPWXV5qnQNt3
s4ga8RseymwUvbNbdBo6x9EdjrM2+iQSrJHbVF0RXRvZT9zRAg+sfzHtGwEeHxQ3
XuLLU2DySLc=
=Kvhw
-----END PGP SIGNATURE-----