(Infoblox Issues Advisory) ISC DHCP Client Identifier Buffer Overflow Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1027312 |
|
SecurityTracker URL: http://securitytracker.com/id/1027312
|
|
CVE Reference:
CVE-2012-3570
(Links to External Site)
|
Date: Jul 26 2012
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in ISC DHCP. A remote user on the local network can cause denial of service conditions. Infoblox NIOS may be affected.
A remote user on the local network can send a specially crafted client identifier parameter value to trigger a buffer overflow and cause the target service to crash.
Systems running in DHCPv6 mode are affected.
Markus Hietava of Codenomicon CROSS project reported this vulnerability via CERT-FI.
|
Impact:
A remote user on the local network can cause the target service to crash.
|
Solution:
Infoblox has issued an advisory, available via the Infoblox Support Center website.
|
Vendor URL: kb.isc.org/article/AA-00714 (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 26 Jul 2012 07:41:17 +0000
Subject: Infoblox
|
Additional details and access to security patches are available within Support Center.
July 24, 2012 – ISC: DNS and DHCP Vulnerabilities (CVE-2012-3954, CVE-2012-3868, CVE-2012-3817, CVE-2012-3571 and CVE-2012-3570)
On July 24, 2012, the Internet Systems Consortium (ISC) announced various vulnerabilities in their DNS and DHCP servers:
CVE-2012-3954 (DHCP): Memory Leaks Found In ISC DHCP
CVE-2012-3868 (DNS): Queue Problems with Empty Queues
CVE-2012-3817 (DNS): DNSSEC Resolver Zone
CVE-2012-3571 (DHCP): An error in the handling of malformed client identifiers can cause a denial-of-service condition in affected servers
CVE-2012-3570 (DHCP): An error in the handling of an unexpected client identifiers can cause a server crash when serving DHCPv6
Please login to the Support Center website for additional details regarding the Infoblox response.
|
|
