CERT-SEI

Format String Vulnerability in ISC DHCPD

Original release date: May 8, 2002
Last revised: Mon Oct 7 09:10:52 EDT 2002
Source: CERT/CC

A complete revision history can be found at the end of this file.

Systems Affected

  • ISC DHCPD 3.0 to 3.0.1rc8 inclusive

Overview

The Internet Software Consortium (ISC) provides a Dynamic Host Configuration Protocol Daemon (DHCPD), which is a server that is used to allocate network addresses and assign configuration parameters to hosts. A format string vulnerability may permit a remote attacker to execute code with the privileges of the DHCPD (typically root). We have not seen active scanning or exploitation of this vulnerability.


I. Description

ISC's DHCPD listens for requests from client machines connecting to the network. Versions 3 to 3.0.1rc8 (inclusive) of DHCPD contains an option (NSUPDATE) that is enabled by default. NSUPDATE allows the DHCP server to send information about the host to the DNS server after processing a DHCP request. The DNS server responds by sending an acknowledgement message back to the DHCP server that may contain user-supplied data (like a host name). When the DHCP server receives the acknowledgement message from the DNS server, it logs the transaction.


A format string vulnerability exists in ISC's DHCPD code that logs the transaction. This vulnerability may permit a remote attacker to execute code with the privileges of the DHCP daemon.

II. Impact

A remote attacker may be able to execute code with the privileges of the DHCPD (typically root).

III. Solution

Note that some of the mitigation steps recommended below may have significant impact on your normal network operations. Ensure that any changes made based on the following recommendations will not unacceptably affect any of your operations.

Apply a patch from your vendor

Appendix A contains information provided by vendors for this advisory.

Disable the DHCP service

As a general rule, the CERT/CC recommends disabling any service or capability that is not explicitly required. Depending on your network configuration, you may not need to use DHCP.

Ingress filtering

As a temporary measure, it may be possible to limit the scope of this vulnerability by blocking access to DHCP services at the network perimeter.

Ingress filtering manages the flow of traffic as it enters a network under your administrative control. In the network usage policy of many sites, there are few reasons for external hosts to initiate inbound traffic to machines that provide no public services. Thus, ingress filtering should be performed at the border to prohibit externally initiated inbound traffic to non-authorized services. For DHCP, ingress filtering of the following ports can prevent attackers outside of your network from reaching vulnerable devices in the local network that are not explicitly authorized to provide public DHCP services.

bootps     67/tcp     # Bootstrap Protocol Server
bootps     67/udp     # Bootstrap Protocol Server
bootpc     68/tcp     # Bootstrap Protocol Client
bootpc     68/udp     # Bootstrap Protocol Client

Appendix A. - Vendor Information

This appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, please check the Vulnerability Note (VU#854315) or contact your vendor directly.

Alcatel

Following the recent CERT advisory on security vulnerabilities in the ISC DHCP implementation, Alcatel has conducted an immediate assessment to determine any impact this may have on our portfolio. A first analysis has shown that only one customer-specific product was affected. Alcatel is working with that customer on a solution. The security of our customers' networks is of highest priority for Alcatel. Therefore we continue to test our product portfolio against potential ISC DHCP security vulnerabilities and will provide updates if necessary.

Apple Computer, Inc.

Mac OS X does not contain this vulnerability.

Conectiva

Please see the Conectiva Linux Announcement.

Cray Inc.

Cray, Inc. is not vulnerable since dhcp is not supported under Unicos or Unicos/mk.

F5 Networks, Inc.

F5 Networks' products do not include any affected version of ISC's DHCPD, and are therefore not vulnerable.

FreeBSD

The FreeBSD base system does not ship with the ISC dhcpd server by default and is not affected by this vulnerability. The ISC dhcpd server is available in the FreeBSD Ports Collection; updates to the ISC dhcp port (ports/net/isc-dhcp3) are in progress and corrected packages will be available in the near future.

Fujitsu Limited

Fujitsu's UXP/V operating system is not vulnerable. UXP/V does not support dhcp.

Hewlett-Packard Company

HP-UX is not vulnerable.

IBM

IBM's AIX operating system, all versions, is not vulnerable.

Internet Software Consortium

A patch is included below, and we have a patched version of 3.0 available (3.0pl1) and a new release candidate for the next bug-fix release (3.0.1RC9).  Both of these new releases are not vulnerable.

--- common/print.c      Tue Apr  9 13:41:17 2002
+++ common/print.c.patched      Tue Apr  9 13:41:56 2002
@@ -1366,8 +1366,8 @@
               *s++ = '.';
       *s++ = 0;
       if (errorp)
-               log_error (obuf);
+               log_error ("%s",obuf);
       else
-               log_info (obuf);
+               log_info ("%s",obuf);
}
#endif /* NSUPDATE */

Lotus Development Corporation

This issue does not affect Lotus products.

Microsoft Corporation

Microsoft does not ship the ISC DHCPD program.

NEC Corporation

EWS/UP 48 Series is NOT vulnerable.

NetBSD

NetBSD fixed this during a format string sweep performed on 11-Oct-2000. No released version of NetBSD is vulnerable to this issue.

Nortel Networks Limited

Nortel Networks products are not impacted by this vulnerability.

Novell

Novell does not ship ISC's DHCPD.

Red Hat

Red Hat Linux has never been shipped with version 3 of dhcpd and therefore none of our releases are vulnerable to this issue.

Silicon Graphics, Inc.

SGI is not vulnerable.

Sun Microsystems

Sun is not vulnerable as Solaris does not ship the ISC DHCPD and does not use any of the ISC DHCPD source in its version of DHCPD.

Xerox

Xerox is aware of this advisory.  A response is available from our web site: http://www.xerox.com/security .


The CERT Coordination Center acknowledges Next Generation Security Technologies as the discoverer of this vulnerability and thanks them and the Internet Software Consortium (ISC) for their cooperation, reporting, and analysis of this vulnerability.


Feedback can be directed to the author: Ian A. Finlay

Copyright 2002 Carnegie Mellon University.

Revision History

May 08, 2002: Initial release
May 09, 2002: Added vendor statement for Nortel Networks Limited
May 10, 2002: Revised vendor statement for Conectiva
May 13, 2002: Added vendor statement for Cray Inc.
May 14, 2002: Added vendor statement for Fujitsu Limited
May 14, 2002: Added vendor statement for Apple Computer, Inc.
May 14, 2002: Added vendor statement for NEC Corporation
May 23, 2002: Added vendor statement for Novell
May 29, 2002: Revised vendor statement for Alcatel
May 31, 2002: Added vendor statement for Sun Microsystems
Jun 11, 2002: Added vendor statement for Red Hat, Inc.
Aug 21, 2002: Added vendor statement for Xerox
Oct 07, 2002: Fixed link for Xerox