The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

- Updated to ISC dhcp-4.2.3-P2 release, providing a DDNS     security fix: Modify the DDNS handling code. In a     previous patch we added logging code to the DDNS     handling. This code included a bug that caused it to     attempt to dereference a NULL pointer and eventually     segfault. While reviewing the code as we addressed this     problem, we determined that some of the updates to the     lease structures would not work as planned since the     structures being updated were in the process of being     freed: these updates were removed. In addition we     removed an incorrect call to the DDNS removal function     that could cause a failure during the removal of DDNS     information from the DNS server. Thanks to Jasper     Jongmans for reporting this issue. ([ISC-Bugs #27078],     CVE: CVE-2011-4868, bnc#741239)

  - Removed obsolete dhcp-4.2.2-CVE-2011-4539-regex-DoS     patch.

The remote host is affected by the vulnerability described in GLSA-201301-06 (ISC DHCP: Denial of Service)

    Multiple vulnerabilities have been discovered in ISC DHCP. Please review       the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities might allow remote attackers to execute arbitrary       code or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

New dhcp packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues.

CVE-2011-4868: error in DDNS processing of DHCPv6 leases can cause ISC dhcpd crash

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ISC reports :

Due to improper handling of a DHCPv6 lease structure, ISC DHCP servers that are serving IPv6 address pools AND using Dynamic DNS can encounter a segmentation fault error while updating lease status under certain conditions.

The potential exists for this condition to be intentionally triggered, resulting in effective denial of service to clients expecting service from the affected server.

ID	Name	Product	Family	Severity
74786	openSUSE Security Update : dhcp (openSUSE-2012-71)	Nessus	SuSE Local Security Checks	medium
63440	GLSA-201301-06 : ISC DHCP: Denial of Service	Nessus	Gentoo Local Security Checks	high
61660	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : dhcp (SSA:2012-237-01)	Nessus	Slackware Local Security Checks	medium
57625	Fedora 16 : dhcp-4.2.3-5.P2.fc16 (2012-0490)	Nessus	Fedora Local Security Checks	medium
57550	FreeBSD : isc-dhcp-server -- DoS in DHCPv6 (1800886c-3dde-11e1-89b4-001ec9578670)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-4868

high

Tenable Plugins

medium

high

medium

medium

medium