Sun Solaris in.dhcpd Malformed BOOTP Packet Buffer Overflow Vulnerability

Bugtraq ID:	5190
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 09 2002 12:00AM
Updated:	Jul 09 2002 12:00AM
Credit:	Discovery first detailed in Sun Patch 109078-07.
Vulnerable:	Sun Solaris 8_x86 Sun Solaris 8_sparc
Not Vulnerable:

Sun Solaris in.dhcpd Malformed BOOTP Packet Buffer Overflow Vulnerability

A vulnerability is present with current implementations of in.dhcpd, which is the Solaris DHCP server. The EDHCP daemon, in.dhcpd, will crash when receiving BOOTP packets which contain a non-null value for the ciaddr field. The ciaddr value is filled in by the client machine if it knows it's own IP address (from previouse requests or from manual configurations) and is able to respond to ARP requests.

An attacker is able to exploit this vulnerability by sending a malformed BOOTP request to the DHCP server containing a non-null value for the ciaddr field.

Sun Solaris in.dhcpd Malformed BOOTP Packet Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sun Solaris in.dhcpd Malformed BOOTP Packet Buffer Overflow Vulnerability

Solution:
Sun has released patches to rectify this vulnerability:


Sun Solaris 8_x86

• Sun 109078-07
  

Sun Solaris 8_sparc

• Sun 109077-10
  

Sun Solaris in.dhcpd Malformed BOOTP Packet Buffer Overflow Vulnerability

References:

• Security Patch Downloads (Sun Microsystems)