The DHCPv6 server in ISC DHCP 4.0.x and 4.1.x before 4.1.2-P1, 4.0-ESV and 4.1-ESV before 4.1-ESV-R1, and 4.2.x before 4.2.1b1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) by sending a message over IPv6 for a declined and abandoned address.

A Denial of Service vulnerability while processing DHCPv6 decline messages hass been fixed. CVE-2011-0413 has been assigned to this issue.

From Red Hat Security Advisory 2011:0256 :

Updated dhcp packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. DHCPv6 is the DHCP protocol version for IPv6 networks.

A flaw was found in the way the dhcpd daemon processed certain DHCPv6 messages for addresses that had previously been declined and marked as abandoned internally. If a remote attacker sent such messages to dhcpd, it could cause dhcpd to crash due to an assertion failure if it was running as a DHCPv6 server. (CVE-2011-0413)

Red Hat would like to thank Internet Systems Consortium for reporting this issue.

Users running dhcpd as a DHCPv6 server should upgrade to these updated packages, which contain a backported patch to correct this issue.
After installing this update, all DHCP servers will be restarted automatically.

This is a SECURITY release of ISC DHCP, which fixes two security related bugs: CVE-2011-0413: DHCPv6 server CVE-2011-0997: dhclient

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the ISC DHCPv6 server does not correctly process requests which come from unexpected source addresses, leading to an assertion failure and a daemon crash.

The oldstable distribution (lenny) is not affected by this problem.

Updated dhcp packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. DHCPv6 is the DHCP protocol version for IPv6 networks.

A flaw was found in the way the dhcpd daemon processed certain DHCPv6 messages for addresses that had previously been declined and marked as abandoned internally. If a remote attacker sent such messages to dhcpd, it could cause dhcpd to crash due to an assertion failure if it was running as a DHCPv6 server. (CVE-2011-0413)

Red Hat would like to thank Internet Systems Consortium for reporting this issue.

Users running dhcpd as a DHCPv6 server should upgrade to these updated packages, which contain a backported patch to correct this issue.
After installing this update, all DHCP servers will be restarted automatically.

A vulnerability has been found and corrected in dhcp :

The DHCPv6 server in ISC DHCP 4.0.x and 4.1.x before 4.1.2-P1, 4.0-ESV and 4.1-ESV before 4.1-ESV-R1, and 4.2.x before 4.2.1b1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) by sending a message over IPv6 for a declined and abandoned address (CVE-2011-0413).

The updated packages have been patched to correct this issue.

A flaw was discovered in the way the dhcpd daemon processed a message for an address that had been previously declined and internally tagged as abandoned. Processing such a message could trigger an assert failure that could crash dhcpd if it was running as a DHCPv6 server.
DHCPv4 servers are unaffected. (CVE-2011-0413)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ISC reports :

When the DHCPv6 server code processes a message for an address that was previously declined and internally tagged as abandoned it can trigger an assert failure resulting in the server crashing. This could be used to crash DHCPv6 servers remotely. This issue only affects DHCPv6 servers. DHCPv4 servers are unaffected.

ID	Name	Product	Family	Severity
75464	openSUSE Security Update : dhcp (openSUSE-SU-2011:0098-1)	Nessus	SuSE Local Security Checks	high
68198	Oracle Linux 6 : dhcp (ELSA-2011-0256)	Nessus	Oracle Linux Local Security Checks	high
53478	Fedora 13 : dhcp-4.1.2-4.ESV.R2.fc13 (2011-0848)	Nessus	Fedora Local Security Checks	high
52551	Debian DSA-2184-1 : isc-dhcp - denial of service	Nessus	Debian Local Security Checks	high
51993	RHEL 6 : dhcp (RHSA-2011:0256)	Nessus	Red Hat Local Security Checks	high
51899	Mandriva Linux Security Advisory : dhcp (MDVSA-2011:022)	Nessus	Mandriva Local Security Checks	high
51842	Fedora 14 : dhcp-4.2.0-19.P2.fc14 (2011-0862)	Nessus	Fedora Local Security Checks	high
51824	FreeBSD : isc-dhcp-server -- DHCPv6 crash (dc9f8335-2b3b-11e0-a91b-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2011-0413

high

Tenable Plugins

high

high

high

high

high

high

high

high