ISC DHCP IPv6 Lease Expiration Handling Denial of Service Vulnerability

Bugtraq ID:	55530
Class:	Unknown
CVE:	CVE-2012-3955
Remote:	Yes
Local:	No
Published:	Sep 12 2012 12:00AM
Updated:	Apr 13 2015 09:42PM
Credit:	Glen Eustace of Massey University
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Slackware Linux x86_64 -current Slackware Linux 13.37 x86_64 Slackware Linux 13.37 Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux -current Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Oracle Solaris 11.1 Oracle Solaris 11 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 ISC DHCP Server 4.2.3 ISC DHCP Server 4.2.2 ISC DHCP Server 4.2.1 ISC DHCP Server 4.1.2 ISC DHCP Server 4.2.4-P1 ISC DHCP Server 4.2.4 ISC DHCP Server 4.2.3-P2 ISC DHCP Server 4.2.3-P1 ISC DHCP Server 4.2.1b1 ISC DHCP Server 4.2.0-P2 ISC DHCP Server 4.2.0-P1 ISC DHCP Server 4.2 ISC DHCP Server 4.1.2-P1 ISC DHCP Server 4.1-ESV-R6 ISC DHCP Server 4.1-ESV-R5 ISC DHCP Server 4.1-ESV-R4 ISC DHCP Server 4.1-ESV-R3 ISC DHCP Server 4.1-ESV-R1 ISC DHCP Server 4.1 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 Avaya IP Office Server Edition 8.1 Avaya Aura Experience Portal 6.0.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700
Not Vulnerable:	ISC DHCP Server 4.2.4-P2 ISC DHCP Server 4.1-ESV-R7

ISC DHCP IPv6 Lease Expiration Handling Denial of Service Vulnerability

ISC DHCP is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause the server to crash, resulting in a denial-of-service condition.

ISC DHCP versions prior to 4.1-ESV-R7 and 4.2.4-P2 are affected.

ISC DHCP IPv6 Lease Expiration Handling Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ISC DHCP IPv6 Lease Expiration Handling Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Slackware Linux -current

• Slackware dhcp-4.2.4_P2-i486-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/dh cp-4.2.4_P2-i486-1.txz

Slackware Linux 12.2

• Slackware dhcp-4.1_ESV_R7-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ dhcp-4.1_ESV_R7-i486-1_slack12.2.tgz

Slackware Linux 13.1 x86_64

• Slackware dhcp-4.1_ESV_R7-x86_64-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/package s/dhcp-4.1_ESV_R7-x86_64-1_slack13.1.txz

Slackware Linux 13.1

• Slackware dhcp-4.1_ESV_R7-i486-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ dhcp-4.1_ESV_R7-i486-1_slack13.1.txz

Slackware Linux 12.1

• Slackware dhcp-4.1_ESV_R7-i486-1_slack12.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ dhcp-4.1_ESV_R7-i486-1_slack12.1.tgz

Slackware Linux x86_64 -current

• Slackware dhcp-4.2.4_P2-x86_64-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ n/dhcp-4.2.4_P2-x86_64-1.txz

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva dhcp-client-4.1.2-0.8mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-common-4.1.2-0.8mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-devel-4.1.2-0.8mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-doc-4.1.2-0.8mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-relay-4.1.2-0.8mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-server-4.1.2-0.8mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva dhcp-client-4.1.2-0.8mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-common-4.1.2-0.8mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-devel-4.1.2-0.8mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-doc-4.1.2-0.8mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-relay-4.1.2-0.8mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-server-4.1.2-0.8mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Slackware Linux 13.0 x86_64

• Slackware dhcp-4.1_ESV_R7-x86_64-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/dhcp-4.1_ESV_R7-x86_64-1_slack13.0.txz

Slackware Linux 13.37 x86_64

• Slackware dhcp-4.2.4_P2-x86_64-1_slack13.37.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packag es/dhcp-4.2.4_P2-x86_64-1_slack13.37.txz

Slackware Linux 13.0

• Slackware dhcp-4.1_ESV_R7-i486-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/ dhcp-4.1_ESV_R7-i486-1_slack13.0.txz

Mandriva Linux Mandrake 2011 x86_64

• Mandriva dhcp-client-4.2.4-0.P2.0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-common-4.2.4-0.P2.0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-devel-4.2.4-0.P2.0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-doc-4.2.4-0.P2.0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-relay-4.2.4-0.P2.0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-server-4.2.4-0.P2.0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2011

• Mandriva dhcp-client-4.2.4-0.P2.0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-common-4.2.4-0.P2.0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-devel-4.2.4-0.P2.0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-doc-4.2.4-0.P2.0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-relay-4.2.4-0.P2.0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva dhcp-server-4.2.4-0.P2.0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/

Slackware Linux 13.37

• Slackware dhcp-4.2.4_P2-i486-1_slack13.37.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages /dhcp-4.2.4_P2-i486-1_slack13.37.txz

ISC DHCP IPv6 Lease Expiration Handling Denial of Service Vulnerability

References:

• Product Homepage (ISC)
  
• CVE-2012-3955 Denial of Service (DoS) vulnerability in ISC DHCP (Oracle)
  
• CVE-2012-3955: Reducing the expiration time for an IPv6 lease may cause the serv (ISC)
  
• dhcp security and bug fix update (RHSA-2013-0504) (Avaya)