Original release date: May 8, 2002<br>
Last revised: Mon Oct 7 09:10:52 EDT 2002<br>
Source: CERT/CC<br>
<p>A complete revision history can be found at the end of this file.</p>
<A NAME="affected"></a>
<h3>Systems Affected</h3>
<ul>
<li>ISC DHCPD 3.0 to 3.0.1rc8 inclusive</li>
</ul>
<A NAME="overview"></a>
<h2>Overview</h2>
<p>
The <a href="http://www.isc.org">Internet Software Consortium
(ISC)</a> provides a <a
href="http://www.isc.org/products/DHCP/">Dynamic Host Configuration
Protocol Daemon (DHCPD)</a>, which is a server that is used to
allocate network addresses and assign configuration parameters to
hosts. A format string vulnerability may permit a remote attacker to
execute code with the privileges of the DHCPD (typically root). We
have not seen active scanning or exploitation of this vulnerability.</p>
<p>
<br>
</p>
<a name="description"></a>
<h2>I. Description</h2>
<p>
ISC's DHCPD listens for requests from client machines connecting to
the network. Versions 3 to 3.0.1rc8 (inclusive) of DHCPD contains an
option (NSUPDATE) that is enabled by default. NSUPDATE allows the DHCP
server to send information about the host to the DNS server after
processing a DHCP request. The DNS server responds by sending an
acknowledgement message back to the DHCP server that may contain
user-supplied data (like a host name). When the DHCP server receives
the acknowledgement message from the DNS server, it logs the
transaction.</p>
<p>
<br>
</p>
<p>
A format string vulnerability exists in ISC's DHCPD code that logs the
transaction. This vulnerability may permit a remote attacker to
execute code with the privileges of the DHCP daemon.
</p>
<a name="impact"></a>
<h2>II. Impact</h2>
<p>A remote attacker may be able to execute code with the privileges
of the DHCPD (typically root).</p>
<a name="solution"></a>
<h2>III. Solution</h2>
<p>Note that some of the mitigation steps recommended below may have
significant impact on your normal network operations. Ensure that
any changes made based on the following recommendations will not
unacceptably affect any of your operations.</p>
<h4>Apply a patch from your vendor</h4>
<p><a href="#vendors">Appendix A</A> contains information provided by
vendors for this advisory.</p>
<h4>Disable the DHCP service</h4>
<p>
As a general rule, the CERT/CC recommends disabling any service or
capability that is not explicitly required. Depending on your network
configuration, you may not need to use DHCP.
</p>
<h4>Ingress filtering</h4>
<p>
As a temporary measure, it may be possible to limit the scope of this
vulnerability by blocking access to DHCP services at the network
perimeter.
</p>
<p>
Ingress filtering manages the flow of traffic as it enters a network
under your administrative control. In the network usage policy of many
sites, there are few reasons for external hosts to initiate inbound
traffic to machines that provide no public services. Thus, ingress
filtering should be performed at the border to prohibit externally
initiated inbound traffic to non-authorized services. For DHCP,
ingress filtering of the following ports can prevent attackers outside
of your network from reaching vulnerable devices in the local network
that are not explicitly authorized to provide public DHCP services.
</p>
<p>
<font face="courier"><small>
bootps 67/tcp #
Bootstrap Protocol Server<br>
bootps 67/udp #
Bootstrap Protocol Server<br>
bootpc 68/tcp #
Bootstrap Protocol Client<br>
bootpc 68/udp #
Bootstrap Protocol Client<br>
</small></font>
</p>
<a name="vendors"></a>
<h2>Appendix A. - Vendor Information</h2>
<p>
This appendix contains information provided by vendors for this
advisory. As vendors report new information to the CERT/CC, we will
update this section and note the changes in our revision history. If a
particular vendor is not listed below, please check the <a
href="http://www.kb.cert.org/vuls/id/854315">Vulnerability Note
(VU#854315)</a> or contact your vendor directly.
</p>
<!-- start vendor -->
<a name="alcatel"></a>
<h4><a href="http://www.alcatel.com">Alcatel</a></h4>
<blockquote>
<p>
Following the recent CERT advisory on security vulnerabilities in the
ISC DHCP implementation, Alcatel has conducted an immediate assessment
to determine any impact this may have on our portfolio. A first
analysis has shown that only one customer-specific product was
affected. Alcatel is working with that customer on a solution. The
security of our customers' networks is of highest priority for
Alcatel. Therefore we continue to test our product portfolio against
potential ISC DHCP security vulnerabilities and will provide updates
if necessary.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="apple"></a>
<h4><a href="http://www.apple.com">Apple Computer, Inc.</a></h4>
<blockquote>
<p>
Mac OS X does not contain this vulnerability.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="conectiva"></a>
<h4><a href="http://www.conectiva.com">Conectiva</a></h4>
<blockquote>
<p>
Please see the <a href="http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000483&idioma=en">Conectiva Linux Announcement</a>.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="cray"></a>
<h4><a href="http://www.cray.com">Cray Inc.</a></h4>
<blockquote>
<p>
Cray, Inc. is not vulnerable since dhcp is not supported under Unicos
or Unicos/mk.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="f5networks"></a>
<h4><a href="http://www.f5.com">F5 Networks, Inc.</a></h4>
<blockquote>
<p>
F5 Networks' products do not include any affected version of ISC's
DHCPD, and are therefore not vulnerable.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="freebsd"></a>
<h4><a href="http://www.freebsd.org">FreeBSD</a></h4>
<blockquote>
<p>
The FreeBSD base system does not ship with the ISC dhcpd server by
default and is not affected by this vulnerability. The ISC dhcpd
server is available in the FreeBSD Ports Collection; updates to the
ISC dhcp port (ports/net/isc-dhcp3) are in progress and corrected
packages will be available in the near future.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="fujitsu"></a>
<h4><a href="http://www.fujitsu.com">Fujitsu Limited</a></h4>
<blockquote>
<p>
Fujitsu's UXP/V operating system is not vulnerable. UXP/V does not
support dhcp.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="hp"></a>
<h4><a href="http://www.hp.com">Hewlett-Packard Company</a></h4>
<blockquote>
<p>
HP-UX is not vulnerable.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="ibm"></a>
<h4><a href="http://www.ibm.com">IBM</a></h4>
<blockquote>
<p>
IBM's AIX operating system, all versions, is not vulnerable.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="isc"></a>
<h4><a href="http://www.isc.org">Internet Software Consortium</a></h4>
<blockquote>
<p>
A patch is included below, and we have a patched version of 3.0 available
(3.0pl1) and a new release candidate for the next bug-fix release (3.0.1RC9).
Both of these new releases are not vulnerable.<br>
<i><br>
--- common/print.c Tue Apr 9 13:41:17 2002<br>
+++ common/print.c.patched Tue Apr 9 13:41:56 2002<br>
@@ -1366,8 +1366,8 @@<br>
*s++ = '.';<br>
*s++ = 0;<br>
if (errorp)<br>
- log_error (obuf);<br>
+ log_error ("%s",obuf);<br>
else<br>
- log_info (obuf);<br>
+ log_info ("%s",obuf);<br>
}<br>
#endif /* NSUPDATE */<br>
</i>
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="lotus"></a>
<h4><a href="http://www.lotus.com">Lotus Development Corporation</a></h4>
<blockquote>
<p>
This issue does not affect Lotus products.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="microsoft"></a>
<h4><a href="http://www.microsoft.com">Microsoft Corporation</a></h4>
<blockquote>
<p>
Microsoft does not ship the ISC DHCPD program.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="nec"></a>
<h4><a href="http://www.nec.com">NEC Corporation</a></h4>
<blockquote>
<p>
EWS/UP 48 Series is NOT vulnerable.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="netbsd"></a>
<H4><a href="http://www.netbsd.org">NetBSD</a></H4>
<blockquote>
<p>
NetBSD fixed this during a format string sweep performed on
11-Oct-2000. No released version of NetBSD is vulnerable to this
issue.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="nortelnetworks"></a>
<H4><a href="http://www.nortelnetworks.com">Nortel Networks Limited</a></H4>
<blockquote>
<p>
Nortel Networks products are not impacted by this vulnerability.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="novell"></a>
<H4><a href="http://www.novell.com">Novell</a></H4>
<blockquote>
<p>
Novell does not ship ISC's DHCPD.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="redhat"></a>
<H4><a href="http://www.redhat.com">Red Hat</a></H4>
<blockquote>
<p>
Red Hat Linux has never been shipped with version 3 of dhcpd and
therefore none of our releases are vulnerable to this issue.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="sgi"></a>
<h4><a href="http://www.sgi.com">Silicon Graphics, Inc.</a></h4>
<blockquote>
<p>
SGI is not vulnerable.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="sun"></a>
<h4><a href="http://www.sun.com">Sun Microsystems</a></h4>
<blockquote>
<p>
Sun is not vulnerable as Solaris does not ship the ISC DHCPD and does
not use any of the ISC DHCPD source in its version of DHCPD.
</p>
</blockquote>
<!-- end vendor -->
<!-- start vendor -->
<a name="xerox"></a>
<h4><a href="http://www.xerox.com">Xerox</a></h4>
<blockquote>
<p>
Xerox is aware of this advisory. A response is available from
our web site: <a
href="http://www.xerox.com/security">http://www.xerox.com/security</a> .
</p>
</blockquote>
<!-- end vendor -->
<hr>
<p>
The CERT Coordination Center acknowledges Next Generation Security
Technologies as the <a
href="http://www.ngsec.com/docs/advisories/NGSEC-2002-2.txt">discoverer</a>
of this vulnerability and thanks them and the Internet Software
Consortium (ISC) for their cooperation, reporting, and analysis of
this vulnerability.</p>
<p></p>
<hr noshade>
<p>
Feedback can be directed to the author: <a href="mailto:cert@cert.org?subject=CA-2002-12%20Feedback%20VU%23854315">Ian A. Finlay</a>
</p>
<p></p>
<!--#include virtual="/include/footer_nocopyright.html" -->
<p>Copyright 2002 Carnegie Mellon University.</p>
<p>Revision History
<pre>
May 08, 2002: Initial release
May 09, 2002: Added vendor statement for Nortel Networks Limited
May 10, 2002: Revised vendor statement for Conectiva
May 13, 2002: Added vendor statement for Cray Inc.
May 14, 2002: Added vendor statement for Fujitsu Limited
May 14, 2002: Added vendor statement for Apple Computer, Inc.
May 14, 2002: Added vendor statement for NEC Corporation
May 23, 2002: Added vendor statement for Novell
May 29, 2002: Revised vendor statement for Alcatel
May 31, 2002: Added vendor statement for Sun Microsystems
Jun 11, 2002: Added vendor statement for Red Hat, Inc.
Aug 21, 2002: Added vendor statement for Xerox
Oct 07, 2002: Fixed link for Xerox
</pre>
</p>
|