Bug 781242 - (CVE-2011-4868) CVE-2011-4868 dhcp: error in DDNS processing of DHCPv6 leases can cause ISC dhcpd crash
CVE-2011-4868 dhcp: error in DDNS processing of DHCPv6 leases can cause ISC d...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120112,repor...
: Reopened, Security
Depends On: 781246
Blocks: 781245
  Show dependency treegraph
 
Reported: 2012-01-12 22:33 EST by Kurt Seifried
Modified: 2012-01-22 08:13 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-01-22 08:13:24 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Kurt Seifried 2012-01-12 22:33:23 EST
http://www.isc.org/advisories

An Error in DDNS Processing of DHCPv6 Leases Can Cause a Crash in ISC dhcpd
Improper handling of Dynamic DNS information associated with DHCPv6 leases can cause a segmentation fault in ISC DHCP servers using IPv6 and Dynamic DNS, resulting in denial of service to clients.

Versions affected: 4.2.2, 4.2.3, 4.2.3-P1

======

From diff:

+                       Changes since 4.2.3-P1
+
+! Modify the DDNS handling code.  In a previous patch we added logging
+  code to the DDNS handling.  This code included a bug that caused it
+  to attempt to dereference a NULL pointer and eventually segfault.
+  While reviewing the code as we addressed this problem, we determined
+  that some of the updates to the lease structures would not work as
+  planned since the structures being updated were in the process of
+  being freed: these updates were removed.  In addition we removed an
+  incorrect call to the DDNS removal function that could cause a failure
+  during the removal of DDNS information from the DNS server.
+  Thanks to Jasper Jongmans for reporting this issue.
+  [ISC-Bugs #27078]

======

The code is not in earlier versions of DHCP.
Comment 1 Kurt Seifried 2012-01-12 22:43:19 EST
Created dhcp tracking bugs for this issue

Affects: fedora-all [bug 781246]
Comment 2 Kurt Seifried 2012-01-13 00:40:45 EST
Confirmed that the DDNS logging code (e.g. the function update_lease_failed()) was added in version 4.2.2. Checked 4.1.1 and 4.2.1 code against the code fixed by this security updates, both 4.2.1 and 4.1.1 lack the DDNS logging code that is vulnerable (the function update_lease_failed() is not present in older versions).
Comment 3 Kurt Seifried 2012-01-13 01:02:06 EST
Statement:

Not vulnerable. This issue did not affect the versions of dhcp as shipped with Red Hat Enterprise Linux 4, 5, and 6 as they did not include support for enhanced DDNS logging.
Comment 4 Fedora Update System 2012-01-22 00:25:31 EST
dhcp-4.2.3-5.P2.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.