(Infoblox Issues Advisory) ISC DHCP Client Identifier Infinite Loop Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1027311 |
|
SecurityTracker URL: http://securitytracker.com/id/1027311
|
|
CVE Reference:
CVE-2012-3571
(Links to External Site)
|
Date: Jul 26 2012
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in ISC DHCP. A remote user on the local network can cause denial of service conditions. Infoblox NIOS may be affected.
A remote user on the local network can send a specially crafted client identifier parameter value to cause the service to enter an infinite loop, preventing the processing of subsequent client requests and consuming excessive CPU resources on the target system.
Markus Hietava of Codenomicon CROSS project reported this vulnerability via CERT-FI.
|
Impact:
A remote user on the local network can cause the target service to consume excessive CPU resources on the target system.
|
Solution:
Infoblox has issued an advisory, available via the Infoblox Support Center website.
|
Vendor URL: kb.isc.org/article/AA-00712 (Links to External Site)
|
Cause:
State error
|
Underlying OS:
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 26 Jul 2012 07:41:17 +0000
Subject: Infoblox
|
Additional details and access to security patches are available within Support Center.
July 24, 2012 – ISC: DNS and DHCP Vulnerabilities (CVE-2012-3954, CVE-2012-3868, CVE-2012-3817, CVE-2012-3571 and CVE-2012-3570)
On July 24, 2012, the Internet Systems Consortium (ISC) announced various vulnerabilities in their DNS and DHCP servers:
CVE-2012-3954 (DHCP): Memory Leaks Found In ISC DHCP
CVE-2012-3868 (DNS): Queue Problems with Empty Queues
CVE-2012-3817 (DNS): DNSSEC Resolver Zone
CVE-2012-3571 (DHCP): An error in the handling of malformed client identifiers can cause a denial-of-service condition in affected servers
CVE-2012-3570 (DHCP): An error in the handling of an unexpected client identifiers can cause a server crash when serving DHCPv6
Please login to the Support Center website for additional details regarding the Infoblox response.
|
|
