ISC DHCP server DHCPv6 decline message processing vulnerability

Overview

ISC DHCPv6 versions 4.0.x - 4.2.x are susceptible to a denial-of-service vulnerability.

Description

The ISC Advisory states:

“When the DHCPv6 server code processes a message for an address that was previously declined and internally tagged as abandoned it can trigger an assert failure resulting in the server crashing. This could be used to crash DHCPv6 servers remotely. This issue only affects DHCPv6 servers. DHCPv4 servers are unaffected.”

---

Impact

A remote attacker may cause a denial of service.

---

Solution

Upgrade
Upgrade to 4.1.2-P1, 4.1-ESV-R1, or 4.2.1b1

---

Vendor Information

686084

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Internet Systems Consortium Affected

Notified: January 24, 2011 Updated: January 26, 2011

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <https://lists.isc.org/pipermail/isc-os-security/2011-January/000000.html&gt;
• <http://www.isc.org/software/dhcp/advisories/cve-2011-0413&gt;

Acknowledgements

Thanks to Larissa Shapiro for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs:	CVE-2011-0413
Severity Metric:	0.95 Date Public: