The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - exit(2) after sending DHCPDECLINE when dhclient has been     started with '-1' (RHBZ #756490)

  - An error in the handling of malformed client identifiers     can cause a denial-of-service condition in affected     servers. (CVE-2012-3571, #843125)

  - Propagate libdhcp timeout to internal timeout_arg (RHBZ     #736515)

  - A pair of defects cause the server to halt upon     processing certain packets (CVE-2011-2748,     CVE-2011-2749, #729881)

  - dhclient.conf(5), dhclient(8) mention that interface-mtu     option is also requested by default (RHBZ #694264)

  - Better fix for CVE-2011-0997: making domain-name check     more lenient (RHBZ #690577)

  - dhclient requests interface-mtu option by default (RHBZ     #694264)

  - dhclient.conf(5) fix (RHBZ #585855)

  - Make dhcpd init script LSB compliant (RHBZ #610128)

  - Use PID for seeding the random number generator in     dhclient (RHBZ #623953)

  - Add DHCRELAYARGS variable to /etc/sysconfig/dhcrelay     (RHBZ #624965)

  - 'lease imbalance' messages are not logged unless     rebalance was actually attempted (RHBZ #661939)

  - Explicitly clear the ARP cache and flush all addresses &     routes instead of bringing the interface down (RHBZ     #685048)

  - IPoIB support (RHBZ #660679)

  - dhclient: insufficient sanitization of certain DHCP     response values (CVE-2011-0997, #690577)

  - A partner-down failover server no longer emits 'peer     holds all free leases' if it is able to newly-allocate     one of the peer's leases. (RHBZ #610219)

  - The server's 'by client-id' and 'by hardware address'     hash table lists are now sorted according to the     preference to re-allocate that lease to returning     clients. This should eliminate pool starvation problems     arising when 'INIT' clients were given new leases rather     than presently active ones. (RHBZ #615995)

This update of dhcp fixes two Denial of Service (CVE-2011-2748, CVE-2011-2749) vulnerabilities caused by specially crafted BOOTP packets.

Also following bugs were fixed :

  - Moved server pid files into chroot directory even chroot     is not used and create a link in /var/run, so it can     write one when started as user without chroot and avoid     stop problems when the chroot sysconfig setting changed     (bnc#712438).

  - Fixed dhclient-script to not remove alias IP when it     didn't changed to not wipe out iptables connmark when     renewing the lease (bnc#700771). Thanks to James Carter     for the patch.

  - Removed GPL licensed files (bind-*/contrib/dbus) from     bind.tgz to ensure, they're not used to build non-GPL     dhcp.

  - Disabled log-info level messages in dhclient(6) quiet     mode to avoid excessive logging of non-critical messages     (bnc#711420).

From Red Hat Security Advisory 2011:1160 :

Updated dhcp packages that fix two security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.

Two denial of service flaws were found in the way the dhcpd daemon handled certain incomplete request packets. A remote attacker could use these flaws to crash dhcpd via a specially crafted request.
(CVE-2011-2748, CVE-2011-2749)

Users of DHCP should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing this update, all DHCP servers will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201301-06 (ISC DHCP: Denial of Service)

    Multiple vulnerabilities have been discovered in ISC DHCP. Please review       the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities might allow remote attackers to execute arbitrary       code or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

This update of dhcp fixes two Denial of Service (CVE-2011-2748 / CVE-2011-2749) vulnerabilities caused by specially crafted BOOTP packets.

Additionally, the alias IP address handling of dhclient-script was fixed to not wipe out iptables connmark when renewing the lease.

This update fixes a pair of defects that could cause the server to halt upon processing certain packets.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in dhcp :

The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet (CVE-2011-2748).

The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet (CVE-2011-2749).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct these issues.

Updated dhcp packages that fix two security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.

Two denial of service flaws were found in the way the dhcpd daemon handled certain incomplete request packets. A remote attacker could use these flaws to crash dhcpd via a specially crafted request.
(CVE-2011-2748, CVE-2011-2749)

Users of DHCP should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing this update, all DHCP servers will be restarted automatically.

David Zych discovered that DHCP incorrectly handled certain malformed packets. A remote attacker could use this issue to cause DHCP to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 / 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1160 advisory.

  - dhcp: denial of service flaws (CVE-2011-2748, CVE-2011-2749)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ISC reports :

A pair of defects cause the server to halt upon processing certain packets. The patch is to properly discard or process those packets.

David Zych discovered that the ISC DHCP crashes when processing certain packets, leading to a denial of service.

ID	Name	Product	Family	Severity
91742	OracleVM 3.2 : dhcp (OVMSA-2016-0058)	Nessus	OracleVM Local Security Checks	high
75814	openSUSE Security Update : dhcp (openSUSE-SU-2011:1021-1)	Nessus	SuSE Local Security Checks	high
75466	openSUSE Security Update : dhcp (openSUSE-SU-2011:1021-1)	Nessus	SuSE Local Security Checks	high
68324	Oracle Linux 4 / 5 / 6 : dhcp (ELSA-2011-1160)	Nessus	Oracle Linux Local Security Checks	high
63440	GLSA-201301-06 : ISC DHCP: Denial of Service	Nessus	Gentoo Local Security Checks	high
57181	SuSE 10 Security Update : dhcp (ZYPP Patch Number 7716)	Nessus	SuSE Local Security Checks	high
57097	SuSE 11.1 Security Update : dhcp (SAT Patch Number 5079)	Nessus	SuSE Local Security Checks	high
56606	SuSE 10 Security Update : dhcp (ZYPP Patch Number 7717)	Nessus	SuSE Local Security Checks	high
56096	Fedora 14 : dhcp-4.2.0-23.P2.fc14 (2011-10705)	Nessus	Fedora Local Security Checks	high
55986	Fedora 15 : dhcp-4.2.1-10.P1.fc15 (2011-10740)	Nessus	Fedora Local Security Checks	high
55948	Fedora 16 : dhcp-4.2.2-1.fc16 (2011-10667)	Nessus	Fedora Local Security Checks	high
55916	Mandriva Linux Security Advisory : dhcp (MDVSA-2011:128)	Nessus	Mandriva Local Security Checks	high
55860	CentOS 4 / 5 : dhcp (CESA-2011:1160)	Nessus	CentOS Local Security Checks	high
55857	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : dhcp3, isc-dhcp vulnerabilities (USN-1190-1)	Nessus	Ubuntu Local Security Checks	high
55855	RHEL 4 / 5 / 6 : dhcp (RHSA-2011:1160)	Nessus	Red Hat Local Security Checks	high
55845	FreeBSD : isc-dhcp-server -- server halt upon processing certain packets (510b630e-c43b-11e0-916c-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	high
55820	Debian DSA-2292-1 : isc-dhcp - denial of service	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2011-2749

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high