ISC DHCP server 4.0 before 4.0.2, 4.1 before 4.1.2, and 4.2 before 4.2.0-P1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a DHCPv6 packet containing a Relay-Forward message without an address in the Relay-Forward link-address field.

ISC DHCP can be crashed with a single dhcpv6 packet. CVE-2010-3611 has been assigned to this issue. Additionally a dhcrelay crash when receiving packets on interfaces without assigned IPv4 address has been fixed as well as an infinite loop in dhcpd.

From Red Hat Security Advisory 2010:0923 :

Updated dhcp packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. DHCPv6 is the DHCP protocol version for IPv6 networks.

A NULL pointer dereference flaw was discovered in the way the dhcpd daemon parsed DHCPv6 packets. A remote attacker could use this flaw to crash dhcpd via a specially crafted DHCPv6 packet, if dhcpd was running as a DHCPv6 server. (CVE-2010-3611)

Users running dhcpd as a DHCPv6 server should upgrade to these updated packages, which contain a backported patch to correct this issue.
After installing this update, all DHCP servers will be restarted automatically.

A NULL pointer dereference flaw was discovered in the way the dhcpd daemon parsed DHCPv6 packets. A remote attacker could use this flaw to crash dhcpd via a specially crafted DHCPv6 packet, if dhcpd was running as a DHCPv6 server. (CVE-2010-3611)

After installing this update, all DHCP servers will be restarted automatically.

Updated dhcp packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. DHCPv6 is the DHCP protocol version for IPv6 networks.

A NULL pointer dereference flaw was discovered in the way the dhcpd daemon parsed DHCPv6 packets. A remote attacker could use this flaw to crash dhcpd via a specially crafted DHCPv6 packet, if dhcpd was running as a DHCPv6 server. (CVE-2010-3611)

Users running dhcpd as a DHCPv6 server should upgrade to these updated packages, which contain a backported patch to correct this issue.
After installing this update, all DHCP servers will be restarted automatically.

ISC reports :

If the server receives a DHCPv6 packet containing one or more Relay-Forward messages, and none of them supply an address in the Relay-Forward link-address field, then the server will crash. This can be used as a single packet crash attack vector.

- Thu Nov 4 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.1.1-27.P1

    - Fix for CVE-2010-3611 (#649880)

    - Wed Oct 13 2010 Jiri Popelka <jpopelka at redhat.com>
      - 12:4.1.1-26.P1

    - Server was ignoring client's Solicit (where client       included address/prefix as a preference) (#634842)

  - Tue Sep 7 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.1.1-25.P1

    - Hardening dhcpd/dhcrelay/dhclient by making them PIE &       RELRO

    - Fri Aug 20 2010 Jiri Popelka <jpopelka at redhat.com>
      - 12:4.1.1-24.P1

    - Add DHCRELAYARGS variable to /etc/sysconfig/dhcrelay

    - Tue Jun 29 2010 Jiri Popelka <jpopelka at redhat.com>
      - 12:4.1.1-23.P1

    - Fix parsing of date (#514828)

    - Thu Jun 3 2010 Jiri Popelka <jpopelka at redhat.com> -       12:4.1.1-22.P1

    - 4.1.1-P1 (pair of bug fixes including one for a       security related bug).

    - Fix for CVE-2010-2156 (#601405)

    - Compile with -fno-strict-aliasing

    - N-V-R (copied from bind.spec):
      Name-Version-Release.Patch.dist

    - Mon May 3 2010 Jiri Popelka <jpopelka at redhat.com> -       12:4.1.1-21

    - Fix the initialization-delay.patch (#587070)

    - Thu Apr 29 2010 Jiri Popelka <jpopelka at redhat.com>
      - 12:4.1.1-20

    - Cut down the 0-4 second delay before sending first       DHCPDISCOVER (#587070)

    - Wed Apr 28 2010 Jiri Popelka <jpopelka at redhat.com>
      - 12:4.1.1-19

    - Move /etc/NetworkManager/dispatcher.d/10-dhclient       script from dhcp to dhclient subpackage (#586999).

  - Wed Apr 28 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.1.1-18

    - Add domain-search to the list of default requested       DHCP options (#586906)

    - Wed Apr 21 2010 Jiri Popelka <jpopelka at redhat.com>
      - 12:4.1.1-17

    - If the Reply was received in response to Renew or       Rebind message, client adds any new addresses in the       IA option to the IA (#578097)

  - Mon Apr 19 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.1.1-16

    - Fill in Elapsed Time Option in Release/Decline       messages (#582939)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Nov 5 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.2.0-14.P1

    - fix broken dependencies

    - Thu Nov 4 2010 Jiri Popelka <jpopelka at redhat.com> -       12:4.2.0-13.P1

    - 4.2.0-P1: fix for CVE-2010-3611 (#649880)

    - dhclient-script: when updating 'search' statement in       resolv.conf, add domain part of hostname if it's not       already there (#637763)

  - Wed Oct 13 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.2.0-12

    - Server was ignoring client's Solicit (where client       included address/prefix as a preference) (#634842)

  - Thu Oct 7 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.2.0-11

    - Use ping instead of arping in dhclient-script to       handle not-on-local-net gateway in ARP-less device       (#524298)

  - Thu Oct 7 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.2.0-10

    - Check whether there is any unexpired address in       previous lease prior to confirming (INIT-REBOOT) the       lease (#585418)

  - Mon Oct 4 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.2.0-9

    - RFC 3442 - ignore Router option only if Classless       Static Routes option contains default router

  - Thu Sep 30 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.2.0-8

    - Explicitly clear the ARP cache and flush all addresses       & routes instead of bringing the interface down       (#574568)

  - Tue Sep 7 2010 Jiri Popelka <jpopelka at redhat.com> -     12:4.2.0-7

    - Hardening dhcpd/dhcrelay/dhclient by making them PIE &       RELRO

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered and corrected in ISC dhcp :

ISC DHCP server 4.0 before 4.0.2, 4.1 before 4.1.2, and 4.2 before 4.2.0-P1 allows remote attackers to cause a denial of service (crash) via a DHCPv6 packet containing a Relay-Forward message without an address in the Relay-Forward link-address field (CVE-2010-3611).

The updated packages have been upgraded to 4.1.2 which is not vulnerable to this issue.

ID	Name	Product	Family	Severity
75463	openSUSE Security Update : dhcp (dhcp-3484)	Nessus	SuSE Local Security Checks	medium
68151	Oracle Linux 6 : dhcp (ELSA-2010-0923)	Nessus	Oracle Linux Local Security Checks	high
60909	Scientific Linux Security Update : dhcp on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
50850	RHEL 6 : dhcp (RHSA-2010:0923)	Nessus	Red Hat Local Security Checks	medium
50815	FreeBSD : isc-dhcp-server -- Empty link-address denial of service (f154a3c7-f7f4-11df-b617-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	medium
50682	Fedora 13 : dhcp-4.1.1-27.P1.fc13 (2010-17303)	Nessus	Fedora Local Security Checks	medium
50592	Fedora 14 : dhcp-4.2.0-14.P1.fc14 (2010-17312)	Nessus	Fedora Local Security Checks	medium
50558	Mandriva Linux Security Advisory : dhcp (MDVSA-2010:226)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-3611

high

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium