Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: Apps A-M :: m-079.txt

Format String Vulnerability in ISC DHCPD (CIAC M-079)


                       The U.S. Department of Energy
                     Computer Incident Advisory Center
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___

                             INFORMATION BULLETIN

                    Format String Vulnerability in ISC DHCPD
                           [CERT Advisory CA-2002-12]

May 8, 2002 18:00 GMT                                             Number M-079
[Revised 24 May 2002]  
PROBLEM:       A format string vulnerability exists in ISC's DHCPD code that 
               logs the transaction. 
PLATFORM:      Any system running ISC DHCPD 3.0 to 3.0.1rc8 inclusive. 
DAMAGE:        A format string vulnerability may permit a remote attacker to 
               execute code with the privileges of the DHCPD (typically root). 
SOLUTION:      Apply the patch supplied by vendor. Depending on your network 
               configuration, CIAC recommends that you disable the DHCP 
VULNERABILITY  The risk is MEDIUM. Neither CERT nor CIAC have seen active 
ASSESSMENT:    scanning or exploitation of this vulnerability. 
 PATCHES:            - 24 May, 2002 - SuSe (Linux) Patches available

[***** Start CERT Advisory CA-2002-12 *****]

CERT Advisory CA-2002-12 Format String Vulnerability in ISC DHCPD

   Original release date: May 8, 2002
   Last revised:--
   Source: CERT/CC

   A complete revision history can be found at the end of this file.

Systems Affected

     * ISC DHCPD 3.0 to 3.0.1rc8 inclusive


   The  Internet  Software  Consortium  (ISC)  provides  a  Dynamic  Host
   Configuration  Protocol Daemon (DHCPD), which is a server that is used
   to  allocate  network addresses and assign configuration parameters to
   hosts.  A  format string vulnerability may permit a remote attacker to
   execute  code  with  the  privileges of the DHCPD (typically root). We
   have not seen active scanning or exploitation of this vulnerability.

I. Description

   ISC's  DHCPD  listens  for requests from client machines connecting to
   the  network.  Versions 3 to 3.0.1rc8 (inclusive) of DHCPD contains an
   option (NSUPDATE) that is enabled by default. NSUPDATE allows the DHCP
   server  to  send  information  about  the host to the DNS server after
   processing  a  DHCP  request.  The  DNS  server responds by sending an
   acknowledgement  message  back  to  the  DHCP  server that may contain
   user-supplied  data  (like a host name). When the DHCP server receives
   the   acknowledgement  message  from  the  DNS  server,  it  logs  the

   A format string vulnerability exists in ISC's DHCPD code that logs the
   transaction.  This  vulnerability  may  permit  a  remote  attacker to
   execute code with the privileges of the DHCP daemon.

II. Impact

   A  remote  attacker may be able to execute code with the privileges of
   the DHCPD (typically root).

III. Solution

   Note  that  some  of  the  mitigation steps recommended below may have
   significant  impact on your normal network operations. Ensure that any
   changes   made   based  on  the  following  recommendations  will  not
   unacceptably affect any of your operations.

Apply a patch from your vendor

   Appendix A contains information provided by vendors for this advisory.

Disable the DHCP service

   As  a  general  rule,  the CERT/CC recommends disabling any service or
   capability  that is not explicitly required. Depending on your network
   configuration, you may not need to use DHCP.

Ingress filtering

   As  a temporary measure, it may be possible to limit the scope of this
   vulnerability  by  blocking  access  to  DHCP  services at the network

   Ingress  filtering  manages the flow of traffic as it enters a network
   under your administrative control. In the network usage policy of many
   sites,  there  are  few reasons for external hosts to initiate inbound
   traffic  to  machines  that  provide no public services. Thus, ingress
   filtering  should  be  performed  at the border to prohibit externally
   initiated  inbound  traffic  to  non-authorized  services.  For  DHCP,
   ingress filtering of the following ports can prevent attackers outside
   of  your network from reaching vulnerable devices in the local network
   that are not explicitly authorized to provide public DHCP services.

   bootps     67/tcp     # Bootstrap Protocol Server
   bootps     67/udp     # Bootstrap Protocol Server
   bootpc     68/tcp     # Bootstrap Protocol Client
   bootpc     68/udp     # Bootstrap Protocol Client

Appendix A. - Vendor Information

   This  appendix  contains  information  provided  by  vendors  for this
   advisory.  As  vendors  report new information to the CERT/CC, we will
   update this section and note the changes in our revision history. If a
   particular  vendor is not listed below, please check the Vulnerability
   Note (VU#854315) or contact your vendor directly.


     The  security of our customers' networks is of highest priority for
     Alcatel.  Alcatel  is  aware  of  this  security  issue in the DHCP
     implementation of ISC and has put measures in place to assess which
     of  its products might be affected and to apply the necessary fixes
     where required. An update will be shortly published to provide more
     details on any affected products.


     Conectiva Linux 8 ships dhcp-3.0 and is vulnerable to this problem.
     Updates  will be available at our ftp site and an announcement will
     be  sent  to  our  mailing  lists  as  soon  as  CERT publishes its

F5 Networks, Inc.

     F5  Networks' products do not include any affected version of ISC's
     DHCPD, and are therefore not vulnerable.


     The  FreeBSD base system does not ship with the ISC dhcpd server by
     default  and  is  not affected by this vulnerability. The ISC dhcpd
     server is available in the FreeBSD Ports Collection; updates to the
     ISC  dhcp  port (ports/net/isc-dhcp3) are in progress and corrected
     packages will be available in the near future.


     IBM's AIX operating system, all versions, is not vulnerable.

Internet Software Consortium

     A  patch  is  included  below, and we have a patched version of 3.0
     available (3.0pl1) and a new release candidate for the next bug-fix
     release (3.0.1RC9).  Both of these new releases are not vulnerable.

     --- common/print.c      Tue Apr  9 13:41:17 2002
     +++ common/print.c.patched      Tue Apr  9 13:41:56 2002
     @@ -1366,8 +1366,8 @@
                    *s++ = '.';
            *s++ = 0;
            if (errorp)
     -               log_error (obuf);
     +               log_error ("%s",obuf);
     -               log_info (obuf);
     +               log_info ("%s",obuf);
     #endif /* NSUPDATE */
Lotus Development Corporation

     This issue does not affect Lotus products.

Microsoft Corporation

     Microsoft does not ship the ISC DHCPD program.


     NetBSD  fixed  this  during  a  format  string  sweep  performed on
     11-Oct-2000.  No  released  version of NetBSD is vulnerable to this

Silicon Graphics, Inc.

     SGI is not vulnerable.

   The  CERT  Coordination  Center  acknowledges Next Generation Security
   Technologies  as  the discoverer of this vulnerability and thanks them
   and  the  Internet  Software  Consortium  (ISC) for their cooperation,
   reporting, and analysis of this vulnerability.

   Feedback can be directed to the author: Ian A. Finlay

   This document is available from:

CERT/CC Contact Information

          Phone: +1 412-268-7090 (24-hour hotline)
          Fax: +1 412-268-6989
          Postal address:
          CERT Coordination Center
          Software Engineering Institute
          Carnegie Mellon University
          Pittsburgh PA 15213-3890

   CERT/CC   personnel   answer  the  hotline  08:00-17:00  EST(GMT-5)  /
   EDT(GMT-4)  Monday  through  Friday;  they are on call for emergencies
   during other hours, on U.S. holidays, and on weekends.

Using encryption

   We  strongly  urge you to encrypt sensitive information sent by email.
   Our public PGP key is available from

   If  you  prefer  to  use  DES,  please  call the CERT hotline for more

Getting security information

   CERT  publications  and  other security information are available from
   our web site

   To  subscribe  to  the CERT mailing list for advisories and bulletins,
   send  email  to Please include in the body of your

   subscribe cert-advisory

   *  "CERT"  and  "CERT  Coordination Center" are registered in the U.S.
   Patent and Trademark Office.

   Any  material furnished by Carnegie Mellon University and the Software
   Engineering  Institute  is  furnished  on  an  "as is" basis. Carnegie
   Mellon University makes no warranties of any kind, either expressed or
   implied  as  to  any matter including, but not limited to, warranty of
   fitness  for  a  particular purpose or merchantability, exclusivity or
   results  obtained from use of the material. Carnegie Mellon University
   does  not  make  any warranty of any kind with respect to freedom from
   patent, trademark, or copyright infringement.

   Conditions for use, disclaimers, and sponsorship information

   Copyright 2002 Carnegie Mellon University.

   Revision History
May 8, 2002:  Initial release

[***** End CERT Advisory CA-2002-12 *****]


CIAC wishes to acknowledge the contributions of CERT for the 
information contained in this bulletin.

CIAC, the Computer Incident Advisory Center, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:
   Anonymous FTP:

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

CIACTech02-003: Protecting Office for Mac X Antipiracy Server Ports
M-070: Apache HTTP Server on Win32 Vulnerability
M-071: Oracle9i User Privileges Vulnerability
M-072: FreeBSD stdio File Descriptors Vulnerability
M-073: Microsoft Outlook E-mail Editor Vulnerability
M-074: SGI IRIX cpr Vulnerability
M-075: HP Security Vulnerability in MPE/iX FTPSRVR
M-076: SGI IRIX nsd symlink Vulnerability
M-077: SGI IRIX Xlib Vulnerability
M-078: Sun Heap Overflow in Cachefs Daemon (cachefsd)

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH