Buffer Overflows in ISC DCHPD Minires Library
Last revised: March 26, 2003
A complete revision history can be found at the end of this file.
- Systems running ISC DHCPD versions 3.0 through 3.0.1RC10, inclusive.
- For detailed vendor status information, see VU#284857
The Internet Software Consortium (ISC) has discovered several buffer overflow vulnerabilities in their implementation of DHCP (ISC DHCPD). These vulnerabilities may allow remote attackers to execute arbitrary code on affected systems. At this time, we are not aware of any exploits.
There are multiple remote buffer overflow vulnerabilities in the ISC implementation of DHCP. As described in RFC 2131, "the Dynamic Host Configuration Protocol (DHCP) provides a framework for passing configuration information to hosts on a TCP/IP network." In addition to supplying hosts with network configuration data, ISC DHCPD allows the DHCP server to dynamically update a DNS server, eliminating the need for manual updates to the name server configuration. Support for dynamic DNS updates is provided by the NSUPDATE feature.
During an internal source code audit, developers from the ISC discovered several vulnerabilities in the error handling routines of the minires library, which is used by NSUPDATE to resolve hostnames. These vulnerabilities are stack-based buffer overflows that may be exploitable by sending a DHCP message containing a large hostname value. Note: Although the minires library is derived from the BIND 8 resolver library, these vulnerabilities do not affect any current versions of BIND.
Remote attackers may be able to execute arbitrary code with the privileges of the user running ISC DHCPD.
Upgrade or apply a patch
The ISC has addressed these vulnerabilities in versions 3.0pl2 and 3.0.1RC11 of ISC DHCPD. If your software vendor supplies ISC DHCPD as part of an operating system distribution, please see Appendix A for vendor-specific patch information.
For a detailed list of vendors that have been notified of this issue by the CERT/CC, please see
Disable dynamic DNS updates (NSUPDATE)
As an interim measure, the ISC recommends disabling the NSUPDATE feature on affected DHCP servers.
Block external access to DHCP server ports
As an interim measure, it is possible to limit exposure to these vulnerabilities by restricting external access to affected DHCP servers on the following ports:
bootps 67/tcp # Bootstrap Protocol Server bootps 67/udp # Bootstrap Protocol Server bootpc 68/tcp # Bootstrap Protocol Client bootpc 68/udp # Bootstrap Protocol Client
Disable the DHCP service
Appendix A. - Vendor Information
This appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments.
Following CERT advisory CA-2003-01 on security vulnerabilities in the ISC DHCP implementation, Alcatel has conducted an immediate assessment to determine any impact this may have on our portfolio. A first analysis has shown that none of our products is impacted. The security of our customers' networks is of highest priority for Alcatel. Therefore we continue to test our product portfolio against potential ISC DHCP security vulnerabilities and will provide updates if necessary.
Apple Computer, Inc.
Mac OS X and Mac OS X Server do not contain the vulnerability described in this notice.
Berkeley Software Design, Inc. (BSDI)
No Cisco products have been found to be affected by this vulnerability.
Cray Inc. is not vulnerable as dhcpd is not supported on any of its products.
Debian has updated their distribution with DSA 231.
For the stable distribution (woody) this problem has been fixed in version 3.0+3.0.1rc9-2.1.
The old stable distribution (potato) does not contain dhcp3 packages.
Fujitsu's UXP/V OS is not vulnerable because it does not support the ISC DHCPD.
Source: Hewlett-Packard Company Software Security Response Team cross reference id: SSRT2423 HP-UX - not vulnerable HP-MPE/ix - not vulnerable HP Tru64 UNIX - not vulnerable HP OpenVMS - not vulnerable HP NonStop Servers - not vulnerable To report potential security vulnerabilities in HP software, send an E-mail message to: mailto:email@example.com
Internet Software Consortium
We have a patched version of 3.0 available (3.0pl2) and a new release candidate for the next bug-fix release (3.0.1RC11). Both of these new releases are available from http://www.isc.org/products/DHCP/.
[Server Products] * EWS/UP 48 Series operating system - is NOT vulnerable.
Currently supported versions of NetBSD do not contain the error handling routine vulnerabilities. Such vulnerabilities were fixed prior to the release of NetBSD 1.5.
With respect to the patch to ns_name.c, we believe that this is good defensive programming and have applied the patch to NetBSD-current. However, all calls to ns_name_ntol in the NetBSD source base pass a correct, constant, non-zero value as the datsiz parameter.
Red Hat Inc.
Red Hat distributes a vulnerable version of ISC DHCP in Red Hat Linux 8.0. Other distributions of Red Hat Linux are not vulnerable to these issues. New DHCP packages are available along with our advisory at the URL below. Users of the Red Hat Network can update their systems using the 'up2date' tool.
Sun Microsystems, Inc.
SuSE Linux AG
A response to this advisory is available from our web site: http://www.xerox.com/security.
The CERT Coordination Center thanks David Hankins of the Internet Software Consortium for notifying us about this problem and for helping us to construct this document. We also thank Jacques A. Vidrine for drawing attention to this issue.
Author: This document was written by Jeffrey P. Lanza.
Copyright 2003 Carnegie Mellon University.
Jan 15, 2003: Initial release
Jan 20, 2003: Added vendor statement for Debian
Jan 28, 2003: Added vendor statement for Microsoft Corporation
Mar 25, 2003: Added vendor statement for Ingrian Networks
Mar 26, 2003: Updated vendor statement for Xerox Corporation
Mar 26, 2003: Added vendor statement for Alcatel