ISC DHCP 'dhcpd -t' Command Insecure Temporary File Creation Vulnerability

Bugtraq ID:	35670
Class:	Race Condition Error
CVE:	CVE-2009-1893
Remote:	No
Local:	Yes
Published:	Jul 14 2009 12:00AM
Updated:	Jan 08 2010 06:51PM
Credit:	Tomas Hoger
Vulnerable:	VMWare VirtualCenter 2.0.2 VMWare VirtualCenter 2.5 VMWare vCenter 4.0 VMWare ESXi Server 4.0 VMWare ESX Server 3.0.3 VMWare ESX Server 4.0 VMWare ESX Server 3.5 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 3 Redhat Desktop 3.0 ISC DHCPD 3.1.1 ISC DHCPD 3.0.4 ISC DHCPD 3.0.1 rc9 + Conectiva Linux Enterprise Edition 1.0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + OpenPKG OpenPKG 1.1 + SuSE Linux 8.1 ISC DHCPD 3.0.1 rc8 ISC DHCPD 3.0.1 rc7 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 4.1.1 ISC DHCPD 3.0.1 rc6 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 ISC DHCPD 3.0.1 rc5 ISC DHCPD 3.0.1 rc4 + OpenPKG OpenPKG 1.0 ISC DHCPD 3.0.1 rc3 ISC DHCPD 3.0.1 rc2 ISC DHCPD 3.0.1 rc14 ISC DHCPD 3.0.1 rc13 ISC DHCPD 3.0.1 rc12 ISC DHCPD 3.0.1 rc11 + OpenPKG OpenPKG 1.2 + OpenPKG OpenPKG Current ISC DHCPD 3.0.1 rc10 + OpenPKG OpenPKG Current ISC DHCPD 3.0.1 rc1 ISC DHCPD 3.0 rc4 + SuSE Linux 7.2 i386 + SuSE Linux 7.2 ISC DHCPD 3.0 rc12 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 ISC DHCPD 3.0 pl2 ISC DHCPD 3.0 pl1 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + Redhat Linux 8.0 i386 + Redhat Linux 8.0 + Slackware Linux 8.1 ISC DHCPD 3.0 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + MandrakeSoft Multi Network Firewall 2.0 + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 - S.u.S.E. Linux Connectivity Server - S.u.S.E. Linux Database Server 0 - S.u.S.E. Linux Enterprise Server for S/390 - S.u.S.E. SuSE eMail Server III - SuSE Linux 8.0 - SuSE Linux 7.3 - SuSE Linux 7.2 - SuSE SUSE Linux Enterprise Server 7 ISC DHCPD 3.0.5b1 ISC DHCPD 3.0.2rc1 ISC DHCPD 2.0.pl5 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha ISC DHCPD 2.0 Admanager Admanager 3.0 pl2
Not Vulnerable:

ISC DHCP 'dhcpd -t' Command Insecure Temporary File Creation Vulnerability

ISC DHCP creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic link attacks to overwrite arbitrary attacker-specified files.

ISC DHCP 'dhcpd -t' Command Insecure Temporary File Creation Vulnerability

An attacker can use readily available commands to exploit the issue.

ISC DHCP 'dhcpd -t' Command Insecure Temporary File Creation Vulnerability

Solution:
The vendor has released an update. Please see the references for details.

ISC DHCP 'dhcpd -t' Command Insecure Temporary File Creation Vulnerability

References:

• [Security-announce] VMSA-2009-0014 VMware ESX patches for DHCP, Service Console (VMware)
  
• Critical: dhcp security update (Red Hat )
  
• ISC DHCP Homepage (ISC)
  
• [Security-announce] UPDATED VMSA-2009-0014.2 VMware ESX patches for DHCP, Servic (VMware)