http://www.isc.org/advisories An Error in DDNS Processing of DHCPv6 Leases Can Cause a Crash in ISC dhcpd Improper handling of Dynamic DNS information associated with DHCPv6 leases can cause a segmentation fault in ISC DHCP servers using IPv6 and Dynamic DNS, resulting in denial of service to clients. Versions affected: 4.2.2, 4.2.3, 4.2.3-P1 ====== From diff: + Changes since 4.2.3-P1 + +! Modify the DDNS handling code. In a previous patch we added logging + code to the DDNS handling. This code included a bug that caused it + to attempt to dereference a NULL pointer and eventually segfault. + While reviewing the code as we addressed this problem, we determined + that some of the updates to the lease structures would not work as + planned since the structures being updated were in the process of + being freed: these updates were removed. In addition we removed an + incorrect call to the DDNS removal function that could cause a failure + during the removal of DDNS information from the DNS server. + Thanks to Jasper Jongmans for reporting this issue. + [ISC-Bugs #27078] ====== The code is not in earlier versions of DHCP.
Created dhcp tracking bugs for this issue Affects: fedora-all [bug 781246]
Confirmed that the DDNS logging code (e.g. the function update_lease_failed()) was added in version 4.2.2. Checked 4.1.1 and 4.2.1 code against the code fixed by this security updates, both 4.2.1 and 4.1.1 lack the DDNS logging code that is vulnerable (the function update_lease_failed() is not present in older versions).
Statement: Not vulnerable. This issue did not affect the versions of dhcp as shipped with Red Hat Enterprise Linux 4, 5, and 6 as they did not include support for enhanced DDNS logging.
dhcp-4.2.3-5.P2.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.