ISC Memory.C DHCP Server Denial Of Service Vulnerability
BID:19348
CVE-2006-3122 |Info
ISC Memory.C DHCP Server Denial Of Service Vulnerability
| Bugtraq ID: | 19348 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-3122 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 04 2006 12:00AM |
| Updated: | Oct 24 2006 11:33PM |
| Credit: | Justin Winschief and Andrew Steets have been credited with the discovery of this vulnerability. |
| Vulnerable: |
Xerox WorkCentre Pro 275 Xerox WorkCentre Pro 265 Xerox WorkCentre Pro 255 Xerox WorkCentre Pro 245 Xerox WorkCentre Pro 238 Xerox WorkCentre Pro 232 Xerox WorkCentre 275 Xerox WorkCentre 265 Xerox WorkCentre 255 Xerox WorkCentre 245 Xerox WorkCentre 238 Xerox WorkCentre 232 Xerox Document Centre 555 Xerox Document Centre 545 Xerox Document Centre 535 Xerox Document Centre 490 ST Xerox Document Centre 490 Xerox Document Centre 480 ST Xerox Document Centre 480 DC Xerox Document Centre 480 Xerox Document Centre 470 ST Xerox Document Centre 470 Xerox Document Centre 460 ST Xerox Document Centre 460 Xerox Document Centre 440 ST Xerox Document Centre 440 DC Xerox Document Centre 440 Xerox Document Centre 432 ST Xerox Document Centre 432 Xerox Document Centre 430 Xerox Document Centre 426 Xerox Document Centre 425 ST Xerox Document Centre 425 Xerox Document Centre 420 ST Xerox Document Centre 420 Xerox Document Centre 340 ST Xerox Document Centre 340 Xerox Document Centre 332 ST Xerox Document Centre 332 Xerox Document Centre 265 ST Xerox Document Centre 265 Xerox Document Centre 255 ST Xerox Document Centre 255 Xerox Document Centre 240 ST Xerox Document Centre 240 Xerox Document Centre 230 ST Xerox Document Centre 230 Xerox Document Centre 220 ST Xerox Document Centre 220 OpenBSD OpenBSD 3.9 OpenBSD OpenBSD 3.8 ISC DHCPD 2.0.pl5 ISC DHCPD 2.0 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha |
| Not Vulnerable: | |
Discussion
ISC Memory.C DHCP Server Denial Of Service Vulnerability
ISC DHCP server is prone to a denial-of-service vulnerability. This issue occurs when an automatic IP address is assigned to a system.
An attacker can exploit this issue to crash the DHCP server, causing a denial-of-service condititon.
This issue affects version 2 releases of DHCP; version 3 releases are reportedly not affected.
ISC DHCP server is prone to a denial-of-service vulnerability. This issue occurs when an automatic IP address is assigned to a system.
An attacker can exploit this issue to crash the DHCP server, causing a denial-of-service condititon.
This issue affects version 2 releases of DHCP; version 3 releases are reportedly not affected.
Exploit / POC
ISC Memory.C DHCP Server Denial Of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]
Solution / Fix
ISC Memory.C DHCP Server Denial Of Service Vulnerability
Solution:
The vendor has released an advisory to address the issue. The vendor has also stated that DHCP 2.x is end-of-life software, so users may want to upgrade to a current version. Please see the referenced advisories for more information.
OpenBSD OpenBSD 3.9
OpenBSD OpenBSD 3.8
ISC DHCPD 2.0.pl5
Solution:
The vendor has released an advisory to address the issue. The vendor has also stated that DHCP 2.x is end-of-life software, so users may want to upgrade to a current version. Please see the referenced advisories for more information.
OpenBSD OpenBSD 3.9
-
OpenBSD 006_dhcpd.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/006_dhcpd.patch
OpenBSD OpenBSD 3.8
-
OpenBSD 011_dhcpd.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/011_dhcpd.patch
ISC DHCPD 2.0.pl5
-
Debian dhcp-client_2.0pl5-19.1sarge2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_alpha.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_amd64.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_arm.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_hppa.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_i386.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_ia64.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_m68k.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_mips.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_mipsel.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_powerpc.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_s390.deb -
Debian dhcp-client_2.0pl5-19.1sarge2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5 -19.1sarge2_sparc.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_alpha.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_amd64.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_arm.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_hppa.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_i386.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_ia64.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_m68k.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_mips.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_mipsel.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_powerpc.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_s390.deb -
Debian dhcp-relay_2.0pl5-19.1sarge2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5- 19.1sarge2_sparc.deb -
Debian dhcp_2.0pl5-19.1sarge2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_alpha.deb -
Debian dhcp_2.0pl5-19.1sarge2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_amd64.deb -
Debian dhcp_2.0pl5-19.1sarge2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_arm.deb -
Debian dhcp_2.0pl5-19.1sarge2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_hppa.deb -
Debian dhcp_2.0pl5-19.1sarge2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_i386.deb -
Debian dhcp_2.0pl5-19.1sarge2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_ia64.deb -
Debian dhcp_2.0pl5-19.1sarge2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_m68k.deb -
Debian dhcp_2.0pl5-19.1sarge2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_mips.deb -
Debian dhcp_2.0pl5-19.1sarge2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_mipsel.deb -
Debian dhcp_2.0pl5-19.1sarge2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_powerpc.deb -
Debian dhcp_2.0pl5-19.1sarge2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_s390.deb -
Debian dhcp_2.0pl5-19.1sarge2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sa rge2_sparc.deb
References
ISC Memory.C DHCP Server Denial Of Service Vulnerability
References:
References:
- Due to an off-by-one error in dhcpd(8) it is possible to cause dhcpd(8) to exit (OpenBSD)
- Due to an off-by-one error in dhcpd(8) it is possible to cause dhcpd(8) to exit (OpenBSD)
- ISC DHCP Protocol Home Page (ISC )
- Xerox Product Response to US-CERT® Technical Cyber Security Alert TA04-174A: Mul (XEROX)
- XEROX SECURITY BULLETIN XRX06-004 (XEROX)