__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Center ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Format String Vulnerability in ISC DHCPD [CERT Advisory CA-2002-12] May 8, 2002 18:00 GMT Number M-079 [Revised 24 May 2002] ______________________________________________________________________________ PROBLEM: A format string vulnerability exists in ISC's DHCPD code that logs the transaction. PLATFORM: Any system running ISC DHCPD 3.0 to 3.0.1rc8 inclusive. DAMAGE: A format string vulnerability may permit a remote attacker to execute code with the privileges of the DHCPD (typically root). SOLUTION: Apply the patch supplied by vendor. Depending on your network configuration, CIAC recommends that you disable the DHCP service. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. Neither CERT nor CIAC have seen active ASSESSMENT: scanning or exploitation of this vulnerability. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/m-079.shtml ORIGINAL BULLETIN: http://www.cert.org/advisories/CA-2002-12.html PATCHES: - 24 May, 2002 - SuSe (Linux) Patches available http://www.suse.de/de/support/security/2002_19_dhcp.html ______________________________________________________________________________ [***** Start CERT Advisory CA-2002-12 *****] CERT Advisory CA-2002-12 Format String Vulnerability in ISC DHCPD Original release date: May 8, 2002 Last revised:-- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected * ISC DHCPD 3.0 to 3.0.1rc8 inclusive Overview The Internet Software Consortium (ISC) provides a Dynamic Host Configuration Protocol Daemon (DHCPD), which is a server that is used to allocate network addresses and assign configuration parameters to hosts. A format string vulnerability may permit a remote attacker to execute code with the privileges of the DHCPD (typically root). We have not seen active scanning or exploitation of this vulnerability. I. Description ISC's DHCPD listens for requests from client machines connecting to the network. Versions 3 to 3.0.1rc8 (inclusive) of DHCPD contains an option (NSUPDATE) that is enabled by default. NSUPDATE allows the DHCP server to send information about the host to the DNS server after processing a DHCP request. The DNS server responds by sending an acknowledgement message back to the DHCP server that may contain user-supplied data (like a host name). When the DHCP server receives the acknowledgement message from the DNS server, it logs the transaction. A format string vulnerability exists in ISC's DHCPD code that logs the transaction. This vulnerability may permit a remote attacker to execute code with the privileges of the DHCP daemon. II. Impact A remote attacker may be able to execute code with the privileges of the DHCPD (typically root). III. Solution Note that some of the mitigation steps recommended below may have significant impact on your normal network operations. Ensure that any changes made based on the following recommendations will not unacceptably affect any of your operations. Apply a patch from your vendor Appendix A contains information provided by vendors for this advisory. Disable the DHCP service As a general rule, the CERT/CC recommends disabling any service or capability that is not explicitly required. Depending on your network configuration, you may not need to use DHCP. Ingress filtering As a temporary measure, it may be possible to limit the scope of this vulnerability by blocking access to DHCP services at the network perimeter. Ingress filtering manages the flow of traffic as it enters a network under your administrative control. In the network usage policy of many sites, there are few reasons for external hosts to initiate inbound traffic to machines that provide no public services. Thus, ingress filtering should be performed at the border to prohibit externally initiated inbound traffic to non-authorized services. For DHCP, ingress filtering of the following ports can prevent attackers outside of your network from reaching vulnerable devices in the local network that are not explicitly authorized to provide public DHCP services. bootps 67/tcp # Bootstrap Protocol Server bootps 67/udp # Bootstrap Protocol Server bootpc 68/tcp # Bootstrap Protocol Client bootpc 68/udp # Bootstrap Protocol Client Appendix A. - Vendor Information This appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, please check the Vulnerability Note (VU#854315) or contact your vendor directly. Alcatel The security of our customers' networks is of highest priority for Alcatel. Alcatel is aware of this security issue in the DHCP implementation of ISC and has put measures in place to assess which of its products might be affected and to apply the necessary fixes where required. An update will be shortly published to provide more details on any affected products. Conectiva Conectiva Linux 8 ships dhcp-3.0 and is vulnerable to this problem. Updates will be available at our ftp site and an announcement will be sent to our mailing lists as soon as CERT publishes its advisory. F5 Networks, Inc. F5 Networks' products do not include any affected version of ISC's DHCPD, and are therefore not vulnerable. FreeBSD The FreeBSD base system does not ship with the ISC dhcpd server by default and is not affected by this vulnerability. The ISC dhcpd server is available in the FreeBSD Ports Collection; updates to the ISC dhcp port (ports/net/isc-dhcp3) are in progress and corrected packages will be available in the near future. IBM IBM's AIX operating system, all versions, is not vulnerable. Internet Software Consortium A patch is included below, and we have a patched version of 3.0 available (3.0pl1) and a new release candidate for the next bug-fix release (3.0.1RC9). Both of these new releases are not vulnerable. --- common/print.c Tue Apr 9 13:41:17 2002 +++ common/print.c.patched Tue Apr 9 13:41:56 2002 @@ -1366,8 +1366,8 @@ *s++ = '.'; *s++ = 0; if (errorp) - log_error (obuf); + log_error ("%s",obuf); else - log_info (obuf); + log_info ("%s",obuf); } #endif /* NSUPDATE */ Lotus Development Corporation This issue does not affect Lotus products. Microsoft Corporation Microsoft does not ship the ISC DHCPD program. NetBSD NetBSD fixed this during a format string sweep performed on 11-Oct-2000. No released version of NetBSD is vulnerable to this issue. Silicon Graphics, Inc. SGI is not vulnerable. _________________________________________________________________ The CERT Coordination Center acknowledges Next Generation Security Technologies as the discoverer of this vulnerability and thanks them and the Internet Software Consortium (ISC) for their cooperation, reporting, and analysis of this vulnerability. _________________________________________________________________ Feedback can be directed to the author: Ian A. Finlay ______________________________________________________________________ This document is available from: http://www.cert.org/advisories/CA-2002-12.html ______________________________________________________________________ CERT/CC Contact Information Email: cert@cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from http://www.cert.org/CERT_PGP.key If you prefer to use DES, please call the CERT hotline for more information. Getting security information CERT publications and other security information are available from our web site http://www.cert.org/ To subscribe to the CERT mailing list for advisories and bulletins, send email to majordomo@cert.org. Please include in the body of your message subscribe cert-advisory * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office. ______________________________________________________________________ NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. _________________________________________________________________ Conditions for use, disclaimers, and sponsorship information Copyright 2002 Carnegie Mellon University. Revision History May 8, 2002: Initial release [***** End CERT Advisory CA-2002-12 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of CERT for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Center, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) CIACTech02-003: Protecting Office for Mac X Antipiracy Server Ports M-070: Apache HTTP Server on Win32 Vulnerability M-071: Oracle9i User Privileges Vulnerability M-072: FreeBSD stdio File Descriptors Vulnerability M-073: Microsoft Outlook E-mail Editor Vulnerability M-074: SGI IRIX cpr Vulnerability M-075: HP Security Vulnerability in MPE/iX FTPSRVR M-076: SGI IRIX nsd symlink Vulnerability M-077: SGI IRIX Xlib Vulnerability M-078: Sun Heap Overflow in Cachefs Daemon (cachefsd)