|
|
In an internal audit, ISC discovered multiple buffer overflow flaws in
versions 3.0 through 3.0.1RC10 of its DHCP product, according to a CERT
advisory.
The flaws lie in a feature of ISC's DHCP product that allows the DHCP server
to automatically update a DNS (Domain Name System) server. An attacker could
take over an affected system by sending a DHCP message containing a large
hostname, according to CERT.
The ISC DHCP software ships as part of products from Red Hat and SuSE Linux;
the vulnerability status of many other vendors is still unknown, CERT said. Red
Hat already has a patch available; SuSE is working on a software update,
according to CERT.
--
Full article and source:  Overseas Security Advisory Council
________________________________
Solution
Upgrade or apply a patch
The ISC has addressed these vulnerabilities in versions 3.0pl2 and 3.0.1RC11
of ISC DHCPD. If your software vendor supplies ISC DHCPD as part of an operating
system distribution, please see Appendix A for
vendor-specific patch information.
For a detailed list of vendors that have been notified of this issue by the
CERT/CC, please see
http://www.kb.cert.org/vuls/id/284857#systems
Disable dynamic DNS updates (NSUPDATE)
As an interim measure, the ISC recommends disabling the NSUPDATE feature on
affected DHCP servers.
Block external access to DHCP server ports
As an interim measure, it is possible to limit exposure to these
vulnerabilities by restricting external access to affected DHCP servers on the
following ports:
bootps 67/tcp # Bootstrap Protocol Server
bootps 67/udp # Bootstrap Protocol Server
bootpc 68/tcp # Bootstrap Protocol Client
bootpc 68/udp # Bootstrap Protocol Client
Disable the DHCP service
As a general rule, the CERT/CC recommends disabling any service or capability
that is not explicitly required. Depending on your network configuration, you
may not need to use DHCP.
Full article and source: CERT
|
|
|
 |
|
No Comments Allowed for Anonymous, please register |
|
| |
|
Login |
|
 |
|
|
|
|
· New User? · Click here to create a registered account.
|
|
|
Article Rating |
|
|
|
|
|
|
Average Score: 0
Votes: 0
|
|
|
