Vulnerabilities > CVE-2011-4868 - Resource Management Errors vulnerability in ISC Dhcp
Attack vector
ADJACENT_NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
COMPLETE Summary
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 107 |
Common Weakness Enumeration (CWE)
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2012-71.NASL description - Updated to ISC dhcp-4.2.3-P2 release, providing a DDNS security fix: Modify the DDNS handling code. In a previous patch we added logging code to the DDNS handling. This code included a bug that caused it to attempt to dereference a NULL pointer and eventually segfault. While reviewing the code as we addressed this problem, we determined that some of the updates to the lease structures would not work as planned since the structures being updated were in the process of being freed: these updates were removed. In addition we removed an incorrect call to the DDNS removal function that could cause a failure during the removal of DDNS information from the DNS server. Thanks to Jasper Jongmans for reporting this issue. ([ISC-Bugs #27078], CVE: CVE-2011-4868, bnc#741239) - Removed obsolete dhcp-4.2.2-CVE-2011-4539-regex-DoS patch. last seen 2020-06-05 modified 2014-06-13 plugin id 74786 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/74786 title openSUSE Security Update : dhcp (openSUSE-2012-71) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2012-71. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(74786); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2011-4539", "CVE-2011-4868"); script_name(english:"openSUSE Security Update : dhcp (openSUSE-2012-71)"); script_summary(english:"Check for the openSUSE-2012-71 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: " - Updated to ISC dhcp-4.2.3-P2 release, providing a DDNS security fix: Modify the DDNS handling code. In a previous patch we added logging code to the DDNS handling. This code included a bug that caused it to attempt to dereference a NULL pointer and eventually segfault. While reviewing the code as we addressed this problem, we determined that some of the updates to the lease structures would not work as planned since the structures being updated were in the process of being freed: these updates were removed. In addition we removed an incorrect call to the DDNS removal function that could cause a failure during the removal of DDNS information from the DNS server. Thanks to Jasper Jongmans for reporting this issue. ([ISC-Bugs #27078], CVE: CVE-2011-4868, bnc#741239) - Removed obsolete dhcp-4.2.2-CVE-2011-4539-regex-DoS patch." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=741239" ); script_set_attribute(attribute:"solution", value:"Update the affected dhcp packages."); script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp-client-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp-relay"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp-relay-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dhcp-server-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1"); script_set_attribute(attribute:"patch_publication_date", value:"2012/01/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-4.2.3.P2-0.6.7.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-client-4.2.3.P2-0.6.7.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-client-debuginfo-4.2.3.P2-0.6.7.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-debuginfo-4.2.3.P2-0.6.7.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-debugsource-4.2.3.P2-0.6.7.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-devel-4.2.3.P2-0.6.7.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-relay-4.2.3.P2-0.6.7.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-relay-debuginfo-4.2.3.P2-0.6.7.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-server-4.2.3.P2-0.6.7.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"dhcp-server-debuginfo-4.2.3.P2-0.6.7.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dhcp / dhcp-client / dhcp-client-debuginfo / dhcp-debuginfo / etc"); }
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_1800886C3DDE11E189B4001EC9578670.NASL description ISC reports : Due to improper handling of a DHCPv6 lease structure, ISC DHCP servers that are serving IPv6 address pools AND using Dynamic DNS can encounter a segmentation fault error while updating lease status under certain conditions. The potential exists for this condition to be intentionally triggered, resulting in effective denial of service to clients expecting service from the affected server. last seen 2020-06-01 modified 2020-06-02 plugin id 57550 published 2012-01-16 reporter This script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57550 title FreeBSD : isc-dhcp-server -- DoS in DHCPv6 (1800886c-3dde-11e1-89b4-001ec9578670) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201301-06.NASL description The remote host is affected by the vulnerability described in GLSA-201301-06 (ISC DHCP: Denial of Service) Multiple vulnerabilities have been discovered in ISC DHCP. Please review the CVE identifiers referenced below for details. Impact : The vulnerabilities might allow remote attackers to execute arbitrary code or cause a Denial of Service. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 63440 published 2013-01-09 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/63440 title GLSA-201301-06 : ISC DHCP: Denial of Service NASL family Fedora Local Security Checks NASL id FEDORA_2012-0490.NASL description CVE-2011-4868: error in DDNS processing of DHCPv6 leases can cause ISC dhcpd crash Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2012-01-23 plugin id 57625 published 2012-01-23 reporter This script is Copyright (C) 2012-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57625 title Fedora 16 : dhcp-4.2.3-5.P2.fc16 (2012-0490) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2012-237-01.NASL description New dhcp packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 61660 published 2012-08-27 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61660 title Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : dhcp (SSA:2012-237-01)