CERT® Advisory CA-2002-12 Format String Vulnerability in ISC DHCPDOriginal release date: May 8, 2002
Last revised: Mon Oct 7 09:10:52 EDT 2002
A complete revision history can be found at the end of this file.
The Internet Software Consortium (ISC) provides a Dynamic Host Configuration Protocol Daemon (DHCPD), which is a server that is used to allocate network addresses and assign configuration parameters to hosts. A format string vulnerability may permit a remote attacker to execute code with the privileges of the DHCPD (typically root). We have not seen active scanning or exploitation of this vulnerability.
ISC's DHCPD listens for requests from client machines connecting to the network. Versions 3 to 3.0.1rc8 (inclusive) of DHCPD contains an option (NSUPDATE) that is enabled by default. NSUPDATE allows the DHCP server to send information about the host to the DNS server after processing a DHCP request. The DNS server responds by sending an acknowledgement message back to the DHCP server that may contain user-supplied data (like a host name). When the DHCP server receives the acknowledgement message from the DNS server, it logs the transaction.
A format string vulnerability exists in ISC's DHCPD code that logs the transaction. This vulnerability may permit a remote attacker to execute code with the privileges of the DHCP daemon.
A remote attacker may be able to execute code with the privileges of the DHCPD (typically root).
Note that some of the mitigation steps recommended below may have significant impact on your normal network operations. Ensure that any changes made based on the following recommendations will not unacceptably affect any of your operations.
Apply a patch from your vendor
Appendix A contains information provided by vendors for this advisory.
Disable the DHCP service
As a general rule, the CERT/CC recommends disabling any service or capability that is not explicitly required. Depending on your network configuration, you may not need to use DHCP.
As a temporary measure, it may be possible to limit the scope of this vulnerability by blocking access to DHCP services at the network perimeter.
Ingress filtering manages the flow of traffic as it enters a network under your administrative control. In the network usage policy of many sites, there are few reasons for external hosts to initiate inbound traffic to machines that provide no public services. Thus, ingress filtering should be performed at the border to prohibit externally initiated inbound traffic to non-authorized services. For DHCP, ingress filtering of the following ports can prevent attackers outside of your network from reaching vulnerable devices in the local network that are not explicitly authorized to provide public DHCP services.
bootps 67/tcp #
Bootstrap Protocol Server
Appendix A. - Vendor Information
This appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, please check the Vulnerability Note (VU#854315) or contact your vendor directly.
The CERT Coordination Center acknowledges Next Generation Security Technologies as the discoverer of this vulnerability and thanks them and the Internet Software Consortium (ISC) for their cooperation, reporting, and analysis of this vulnerability.
Feedback can be directed to the author: Ian A. Finlay
This document is available from: http://www.cert.org/advisories/CA-2002-12.html
CERT/CC Contact Information
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.
We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from
If you prefer to use DES, please call the CERT hotline for more information.
Getting security information
CERT publications and other security information are available from our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
Conditions for use, disclaimers, and sponsorship information
Copyright 2002 Carnegie Mellon University.
May 08, 2002: Initial release May 09, 2002: Added vendor statement for Nortel Networks Limited May 10, 2002: Revised vendor statement for Conectiva May 13, 2002: Added vendor statement for Cray Inc. May 14, 2002: Added vendor statement for Fujitsu Limited May 14, 2002: Added vendor statement for Apple Computer, Inc. May 14, 2002: Added vendor statement for NEC Corporation May 23, 2002: Added vendor statement for Novell May 29, 2002: Revised vendor statement for Alcatel May 31, 2002: Added vendor statement for Sun Microsystems Jun 11, 2002: Added vendor statement for Red Hat, Inc. Aug 21, 2002: Added vendor statement for Xerox Oct 07, 2002: Fixed link for Xerox