Security Vulnerabilities in DHCP Handling of DHCP Requests May Allow Remote Users to Execute Arbitrary Code or Cause a Denial of the DHCP Service

---

Security Vulnerabilities in DHCP Handling of DHCP Requests May Allow Remote Users to Execute Arbitrary Code or Cause a Denial of the DHCP Service

1. Impact

Security vulnerabilities in the DHCP (in.dhcpd(1M)) server handling of DHCP requests may allow a remote unprivileged user to kill the DHCP server daemon (Denial of Service) or to execute arbitrary code as the root user.

One of the issues described here is also referenced in the following document:

CVE-2007-5365 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5365

2. Contributing Factors

These issues can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 109077-21
• Solaris 9 without patch 112837-16
• Solaris 10 without patch 138876-01
• OpenSolaris based upon builds snv_01 through snv_102

x86 Platform

• Solaris 8 without patch 109078-21
• Solaris 9 without patch 114265-15
• Solaris 10 without patch 138877-01
• OpenSolaris based upon builds snv_01 through snv_102

Notes:

1. Only OpenSolaris installations which include the affected binary /usr/lib/inet/in.dhcpd and have the DHCP server configured and running are impacted by this issue.

2. OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. The base build can be derived as follows:

$ uname -v
snv_86

3. Only systems which are configured as a DHCP server are impacted by this issue. To determine if a system is configured as a DHCP server, the following command can be run.

$ svcs svc:/network/dhcp-server:default
STATE         STIME    FMRI
online        Sep_09   svc:/network/dhcp-server:default

If the output shows the state is online, then the system is configured as a DHCP server.

3. Symptoms

The security vulnerability which allows arbitrary code executio, has no reliable symptoms that would indicate the issue has been exploited.

The security vulnerability which allows a denial of of teh DHCP service will result in the DHCP server daemon exiting with an "Assertion failed" error message.

4. Workaround

There are no workarounds for these issues. Please see the Resolution section below.

5. Resolution

These issues are addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 109077-21 or later
• Solaris 9 with patch 112837-16 or later
• Solaris 10 with patch 138876-01 or later
• OpenSolaris based upon builds snv_103 or later

x86 Platform

• Solaris 8 with patch 109078-21 or later
• Solaris 9 with patch 114265-15 or later
• Solaris 10 with patch 138877-01 or later
• OpenSolaris based upon builds snv_103 or later

For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.




Attachments

This solution has no attachment