View Source

Original release date: January 15, 2003<br>
Last revised: March 26, 2003<br>
Source: CERT/CC<br>

<p>A complete revision history can be found at the end of this file.</p>

<br>
<a name="affected"></a>
<h3>Systems Affected</h3>

<ul>

<li>Systems running ISC DHCPD versions 3.0 through 3.0.1RC10, inclusive.
</li>

<li>For detailed vendor status information, see <A
HREF="http://www.kb.cert.org/vuls/id/284857#systems">VU#284857</a>
</li>

</ul>

<br>
<a name="overview"></a>
<h2>Overview</h2>

<p>The <a href="http://www.isc.org">Internet Software Consortium</a> (ISC)
has discovered several buffer overflow vulnerabilities in their
implementation of DHCP (ISC DHCPD).  These vulnerabilities may allow
remote attackers to execute arbitrary code on affected systems.  At this
time, we are not aware of any exploits.</p>

<br>
<a name="description"></a>
<h2>I. Description</h2>

<p>There are multiple remote buffer overflow vulnerabilities in the ISC
implementation of DHCP. As described in <a
href="http://www.ietf.org/rfc/rfc2131.txt">RFC 2131</a>, "the Dynamic Host
Configuration Protocol (DHCP) provides a framework for passing
configuration information to hosts on a TCP/IP network."  In addition to
supplying hosts with network configuration data, ISC DHCPD allows the DHCP
server to dynamically update a DNS server, eliminating the need for manual
updates to the name server configuration.  Support for dynamic DNS updates
is provided by the NSUPDATE feature.

<p>During an internal source code audit, developers from the ISC
discovered several vulnerabilities in the error handling routines of the
minires library, which is used by NSUPDATE to resolve hostnames.  These
vulnerabilities are stack-based buffer overflows that may be exploitable
by sending a DHCP message containing a large hostname value.  <i>Note:
Although the minires library is derived from the BIND 8 resolver library,
these vulnerabilities do not affect any current versions of BIND.</i>

<p>The CERT/CC is tracking this issue as <A
HREF="http://www.kb.cert.org/vuls/id/284857">VU#284857</A>.  This
reference number corresponds to <A
HREF="http://www.cve.mitre.org/">CVE</A> candidate <A
HREF="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0026">CAN-2003-0026</A>.</p>

<br>
<a name="impact"></a>
<h2>II. Impact</h2>

<p>Remote attackers may be able to execute arbitrary code with the
privileges of the user running ISC DHCPD.</p>

<br>
<a name="solution"></a>
<h2>III. Solution</h2>

<h4>Upgrade or apply a patch</h4>

<p>The ISC has addressed these vulnerabilities in versions 3.0pl2 and
3.0.1RC11 of ISC DHCPD.  If your software vendor supplies ISC DHCPD as
part of an operating system distribution, please see <a
href="#vendors">Appendix A</a> for vendor-specific patch information.

<p>For a detailed list of vendors that have been notified of this issue by
the CERT/CC, please see

<blockquote>
<A
HREF="http://www.kb.cert.org/vuls/id/284857#systems">http://www.kb.cert.org/vuls/id/284857#systems</a>
</blockquote>

<h4>Disable dynamic DNS updates (NSUPDATE)</h4>

<p>As an interim measure, the ISC recommends disabling the NSUPDATE
feature on affected DHCP servers.

<h4>Block external access to DHCP server ports</h4>

<p>As an interim measure, it is possible to limit exposure to these
vulnerabilities by restricting external access to affected DHCP servers on
the following ports:

<blockquote>
<tt><pre>
bootps      67/tcp      # Bootstrap Protocol Server
bootps      67/udp      # Bootstrap Protocol Server
bootpc      68/tcp      # Bootstrap Protocol Client
bootpc      68/udp      # Bootstrap Protocol Client
</pre></tt>
</blockquote>

<h4>Disable the DHCP service</h4>

<p>As a general rule, the CERT/CC recommends disabling any service or
capability that is not explicitly required.  Depending on your network
configuration, you may not need to use DHCP.

<br>
<a name="vendors"></a>
<h2>Appendix A. - Vendor Information</h2>

<p>This appendix contains information provided by vendors for this
advisory.  As vendors report new information to the CERT/CC, we will
update this section and note the changes in our revision history.  If a
particular vendor is not listed below, we have not received their
comments.</p>

<a name="alcatel"></a>
<h4>Alcatel</h4>

<P>Following CERT advisory CA-2003-01 on security vulnerabilities in the
ISC DHCP implementation, Alcatel has conducted an immediate assessment to
determine any impact this may have on our portfolio. A first analysis has
shown that none of our products is impacted. The security of our
customers' networks is of highest priority for Alcatel. Therefore we
continue to test our product portfolio against potential ISC DHCP security
vulnerabilities and will provide updates if necessary.

<!-- end vendor -->

<a name="apple"></a>
<h4>Apple Computer, Inc.</h4>

<p>Mac OS X and Mac OS X Server do not contain the vulnerability described
in this notice.</p>

<!-- end vendor -->

<a name="bsdi"></a>
<h4>Berkeley Software Design, Inc. (BSDI)</h4>

<p>This vulnerability is addressed by the M431-001 and M500-004 patches
for the 4.3.1 and 5.0 versions of BSD/OS.

<!-- end vendor -->

<a name="cisco"></a>
<h4>Cisco Systems</h4>

<p>No Cisco products have been found to be affected by this vulnerability.

<p>Several Cisco products do utilize the ISC DHCPD, however, no Cisco
products implement the ISC DHCPD NSUPDATE feature, nor do they include the
minires library.

<!-- end vendor -->

<a name="cray"></a>
<h4>Cray Inc.</h4>

<p>Cray Inc. is not vulnerable as dhcpd is not supported on any of its
products.</p>

<!-- end vendor -->

<a name="debian"></a>
<h4>Debian</h4>

<p>Debian has updated their distribution with DSA 231.

<p>For the stable distribution (woody) this problem has been fixed in
version 3.0+3.0.1rc9-2.1.

<p>The old stable distribution (potato) does not contain dhcp3 packages.

<p>For the unstable distribution (sid) this problem has been fixed in
version 3.0+3.0.1rc11-1.

<!-- end vendor -->


<a name="fujitsu"></a>
<h4>Fujitsu</h4>

<p>Fujitsu's UXP/V OS is not vulnerable because it does not support the ISC DHCPD.</p>

<!-- end vendor -->

<a name="hp"></a>
<h4>Hewlett-Packard Company</h4>

<tt><pre>
Source: Hewlett-Packard Company 
        Software Security Response Team


cross reference id: SSRT2423

  HP-UX         - not vulnerable
  HP-MPE/ix     - not vulnerable
  HP Tru64 UNIX - not vulnerable
  HP OpenVMS    - not vulnerable
  HP NonStop Servers - not vulnerable

To report potential security vulnerabilities in HP software,
send an E-mail message to: <a href="mailto:security-alert@hp.com">mailto:security-alert@hp.com</a>
</pre></tt>

<!-- end vendor -->

<a name="hitachi"></a>
<h4>Hitachi, Ltd.</h4>

<p>We've checked up on our router (Hitachi,Ltd. GR2000 series) about
[VU#284857].  Our DHCP implementation is NOT vulnerable.

<!-- end vendor -->

<a name="ibm"></a>
<h4>IBM Corporation</h4>

<p>IBM's AIX does not ship with the ISC DHCP daemon. The issues discussed in
VU#284857 or any following advisories based on this vulnerability note do
not pertain to AIX.

<!-- end vendor -->

<a name="ingrian"></a>
<h4>Ingrian Networks</h4>

<p>Ingrian Networks products are not vulnerable to VU#284857.

<!-- end vendor -->

<a name="isc"></a>
<h4>Internet Software Consortium</h4>

<p>We have a patched version of 3.0 available (3.0pl2) and a new release
candidate for the next bug-fix release (3.0.1RC11).  Both of these new
releases are available from <a
href="http://www.isc.org/products/DHCP/">http://www.isc.org/products/DHCP/</a>.

<!-- end vendor -->

<a name="microsoft"></a>
<h4>Microsoft Corporation</h4>

<p>Microsoft products do not use the libraries in question. Microsoft
products are not affected by this vulnerability.

<!-- end vendor -->

<a name="montavista"></a>
<h4>MontaVista Software</h4>

<p>None of MontaVista Software's Linux products are vulnerable to this
issue.

<!-- end vendor -->

<a name="nec"></a>
<h4>NEC Inc.</h4>

<tt><pre>
[Server Products]

 * EWS/UP 48 Series operating system
 - is NOT vulnerable.
</pre></tt>
<!-- end vendor -->

<a name="netbsd"></a>
<h4>NetBSD</h4>

<p>Currently supported versions of NetBSD do not contain the error handling
routine vulnerabilities.  Such vulnerabilities were fixed prior to the
release of NetBSD 1.5.

<p>With respect to the patch to ns_name.c, we believe that this is good
defensive programming and have applied the patch to
NetBSD-current. However, all calls to ns_name_ntol in the NetBSD source
base pass a correct, constant, non-zero value as the datsiz parameter.

<p>Therefore, NetBSD is not vulnerable.

<!-- end vendor -->

<a name="netscreen"></a>
<h4>NetScreen</h4>

<p>NetScreen is not vulnerable to this issue.

<!-- end vendor -->

<a name="openbsd"></a>
<h4>OpenBSD</h4>

<p>OpenBSD's dhcp support is much modified, does not have that feature,
and therefore does not have that bug.

<!-- end vendor -->

<a name="openwall"></a>
<h4>Openwall GNU/*/Linux</h4>

<p>Openwall GNU/*/Linux is not vulnerable.  We don't yet provide a DHCP
suite.

<!-- end vendor -->

<a name="redhat"></a>
<h4>Red Hat Inc.</h4>

<p>Red Hat distributes a vulnerable version of ISC DHCP in Red Hat Linux
8.0.  Other distributions of Red Hat Linux are not vulnerable to these
issues.  New DHCP packages are available along with our advisory at the
URL below.  Users of the Red Hat Network can update their systems using
the 'up2date' tool.

<blockquote>
<a
href="http://rhn.redhat.com/errata/RHSA-2003-011.html">http://rhn.redhat.com/errata/RHSA-2003-011.html</a>
</blockquote>

<!-- end vendor -->

<a name="riverstone"></a>
<h4>Riverstone Networks</h4>

<p>Riverstone Networks is not vulnerable to VU#284857.

<!-- end vendor -->

<a name="sun"></a>
<h4>Sun Microsystems, Inc.</h4>

<p>Sun confirms that we are not vulnerable to the issues described in
VU#284857.  Solaris does not ship the ISC DHCPD and does not use any of
the ISC DHCPD source in its version of DHCPD.

<!-- end vendor -->

<a name="suse"></a>
<h4>SuSE Linux AG</h4>

<p>We are preparing updates, that will be released soon.

<!-- end vendor -->

<a name="xerox"></a>
<h4>Xerox</h4>

<p>A response to this advisory is available from our web site:  <a
href="http://www.xerox.com/security">http://www.xerox.com/security</a>.

<!-- end vendor -->
<hr noshade>

<p>The CERT Coordination Center thanks David Hankins of the Internet
Software Consortium for notifying us about this problem and for helping us
to construct this document.  We also thank Jacques A. Vidrine for drawing
attention to this issue.</p>

<p></p>

<hr noshade>

<p>Author: This document was written by <a
href="mailto:cert@cert.org?subject=CA-2003-01%20Feedback%20VU%23284857">Jeffrey
P. Lanza</a>.

<p></p>

<!--#include virtual="/include/footer_nocopyright.html" -->

<p>Copyright 2003 Carnegie Mellon University.</p>

<p>Revision History
<tt><pre>
Jan 15, 2003:  Initial release
Jan 20, 2003:  Added vendor statement for Debian
Jan 28, 2003:  Added vendor statement for Microsoft Corporation
Mar 25, 2003:  Added vendor statement for Ingrian Networks
Mar 26, 2003:  Updated vendor statement for Xerox Corporation
Mar 26, 2003:  Added vendor statement for Alcatel
</pre></tt>
</p>