ISC DHCP contains a format string vulnerabilty in errwarn.c

Overview

The Internet Systems Consortium (ISC) Dynamic Host Configuration Protocol (DHCP) application contains a format string vulnerability in errwarn.c that could allow an attacker to execute arbitrary code.

Description

As described in RFC 2131, “The Dynamic Host Configuration Protocol (DHCP) provides a framework for passing configuration information to hosts on a TCP/IP network.” ISC DHCP is a reference implementation of the DHCP protocol, including a DHCP server, client, and relay agent.

The code that handles error and warning messages (errwarn.c) contains several instances of a format string vulnerability. An insufficient number of parameters is passed to the syslog function, which creates the format string vulnerability. The vulnerable code is used by the DHCP client, server, and relay.

---

Impact

A remote, unauthenticated attacker may be able to execute code on the DHCP server with the privileges of the DHCPD process (typically root). An attacker may also be able to execute code on a system running the DHCP client or agent, since these also use the vulnerable code in errwarn.c.

---

Solution

Apply a patch or update from your vendor
For vendor-specific information regarding vulnerable status and patch availability, please see the Systems Affected section of this document.

Upgrade your version of DHCP

Upgrade your system as specified by your vendor. If you need to upgrade DHCP manually, get DHCP 3.0.1. This vulnerability affects DHCP 2.0pl5 and prior, and 3.0b1-pl17 and prior.

---

Ingress filtering

It may be possible to limit the scope of this vulnerability by blocking access to DHCP services at the network perimeter.

Ingress filtering manages the flow of traffic as it enters a network under your administrative control. In the network usage policy of many sites, there are few reasons for external hosts to initiate inbound traffic to machines that provide no public services. Thus, ingress filtering should be performed at the border to prohibit externally initiated inbound traffic to non-authorized services. For DHCP, ingress filtering of the following ports can prevent attackers outside of your network from reaching vulnerable devices in the local network that are not explicitly authorized to provide public DHCP services.

bootps 67/tcp # Bootstrap Protocol Server
bootps 67/udp # Bootstrap Protocol Server
bootpc 68/tcp # Bootstrap Protocol Client
bootpc 68/udp # Bootstrap Protocol Client

---

Vendor Information

448384

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

ISC __ Affected

Notified: December 14, 2004 Updated: December 16, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

MontaVista Software __ Affected

Notified: December 17, 2004 Updated: December 17, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Red Hat Inc. __ Affected

Notified: December 17, 2004 Updated: August 01, 2005

Status

Affected

Vendor Statement

Updates are available for Red Hat Enterprise Linux 2.1 to correct this
issue. Red Hat Enterprise Linux 3 and 4 were not affected by this issue.
New dhcp packages along with our advisory are available at the URL below
and by using the Red Hat Network ‘up2date’ tool.

<http://rhn.redhat.com/errata/RHSA-2005-212.html&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Hitachi __ Not Affected

Notified: December 17, 2004 Updated: December 22, 2004

Status

Not Affected

Vendor Statement

Hitachi HI-UX/WE2 is NOT VULNERABLE to this issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

NEC Corporation __ Not Affected

Notified: December 17, 2004 Updated: March 09, 2005

Status

Not Affected

Vendor Statement

NEC products are NOT susceptible to this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

SGI __ Not Affected

Notified: December 17, 2004 Updated: December 22, 2004

Status

Not Affected

Vendor Statement

SGI IRIX and SGI Advance Linux Environment does not ise ISC DHCP code, so they are not vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Apple Computer Inc. __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Conectiva __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Cray Inc. __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Debian __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

EMC Corporation __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Engarde __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

F5 Networks __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

FreeBSD __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Fujitsu __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

IBM __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

IBM eServer __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

For information related to this and other published CERT
Advisories that may relate to the IBM eServer Platforms (xSeries,
iSeries, pSeries, and zSeries) please go to
https://app-06.www.ibm.com/servers/resourcelink/lib03020.nsf/pages/securityalerts?OpenDocument&pathID=

In order to access this information you will require a Resource Link ID.
To subscribe to Resource Link go to
<http://app-06.www.ibm.com/servers/resourcelink&gt;
and follow the steps for registration.

All questions should be refferred to [email protected].

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

IBM-zSeries __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Immunix __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Ingrian Networks __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Juniper Networks __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

MandrakeSoft __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Microsoft Corporation __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

NETBSD __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Nokia __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Novell __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

OpenBSD __ Unknown

Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Openwall GNU/*/Linux __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

SCO __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Sequent __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Sony Corporation __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

SuSE Inc. __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Sun Microsystems Inc. __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

TurboLinux __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Unisys __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

Wind River Systems Inc. __ Unknown

Notified: December 17, 2004 Updated: December 17, 2004

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23448384 Feedback>).

View all 36 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.securityfocus.com/bid/11591&gt;
• <http://xforce.iss.net/xforce/xfdb/17963&gt;
• <http://osvdb.org/displayvuln.php?osvdb_id=11527&gt;
• http://marc.theaimsgroup.com/?l=dhcp-announce&m=109996073218290&w=2

Acknowledgements

This vulnerability was publicly disclosed by infamous41md.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2004-1006
Severity Metric:	10.26 Date Public: