Bug 842420 (CVE-2012-3571)

Summary:	CVE-2012-3571 dhcp: DoS due to error in handling malformed client identifiers
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jpopelka, ljozsa, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-19 21:55:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	842892, 843120, 843122, 843124, 843125
Bug Blocks:	842431

Description Vincent Danen 2012-07-23 20:19:02 UTC

An error in the handling of malformed client identifiers can cause a DHCP
server running affected versions to enter a state where further client
requests are not processed and the server process loops endlessly,
consuming all available CPU cycles.

Under normal circumstances this condition should not be triggered, but a
non-conforming or malicious client could deliberately trigger it in a
vulnerable server. In order to exploit this condition an attacker must be
able to send requests to the DHCP server .

ISC DHCP versions 4.2.x through to 4.2.4 are affected, as well as 4.1.x.  Earlier versions may also be vulnerable.

Acknowledgements:

Upstream acknowledges Markus Hietava of Codenomicon CROSS project as the original reporter of this issue.

Comment 2 Vincent Danen 2012-07-24 20:35:56 UTC

This is now public:

https://kb.isc.org/article/AA-00712

Comment 3 Vincent Danen 2012-07-24 20:37:40 UTC

Created dhcp tracking bugs for this issue

Affects: fedora-all [bug 842892]

Comment 10 Fedora Update System 2012-08-01 18:27:59 UTC

dhcp-4.2.4-9.P1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 errata-xmlrpc 2012-08-03 00:28:00 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1141 https://rhn.redhat.com/errata/RHSA-2012-1141.html

Comment 12 errata-xmlrpc 2012-08-03 00:28:08 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1140 https://rhn.redhat.com/errata/RHSA-2012-1140.html

Comment 13 Fedora Update System 2012-08-06 07:50:19 UTC

dhcp-4.2.3-11.P2.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.