mir/isc-dhcp
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/dhcp synced 2025-08-22 18:07:25 +00:00
Code Issues Releases Wiki Activity

Two packets were found that cause a server to halt. The code

Browse Source 
has been updated to properly process or reject the packets as
appropriate.  Thanks to David Zych at University of Illinois
for reporting this issue.  [ISC-Bugs #24960]
One CVE number for each class of packet.
CVE-2011-2748
CVE-2011-2749
This commit is contained in:
Shawn Routhier 2011-07-19 22:13:26 +00:00
parent beaed73f00
commit 8bd96ccb21
4 changed files with 23 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
RELNOTES
View File

@ -190,6 +190,14 @@ work on other platforms. Please report any problems and suggested fixes to
in site.h then server will be terminated in site.h then server will be terminated
[ISC-Bugs #23595] [ISC-Bugs #23595]
! Two packets were found that cause a server to halt. The code
has been updated to properly process or reject the packets as
appropriate. Thanks to David Zych at University of Illinois
for reporting this issue. [ISC-Bugs #24960]
One CVE number for each class of packet.
CVE-2011-2748
CVE-2011-2749
Changes since 4.2.0 Changes since 4.2.0
- Documentation cleanup covering multiple tickets - Documentation cleanup covering multiple tickets

16
common/discover.c
View File

@ -1403,12 +1403,16 @@ isc_result_t got_one (h)
if (result == 0) if (result == 0)
return ISC_R_UNEXPECTED; return ISC_R_UNEXPECTED;
/* If we didn't at least get the fixed portion of the BOOTP /*
packet, drop the packet. We're allowing packets with no * If we didn't at least get the fixed portion of the BOOTP
sname or filename, because we're aware of at least one * packet, drop the packet.
client that sends such packets, but this definitely falls * Previously we allowed packets with no sname or filename
into the category of being forgiving. */ * as we were aware of at least one client that did. But
if (result < DHCP_FIXED_NON_UDP - DHCP_SNAME_LEN - DHCP_FILE_LEN) * a bug caused short packets to not work and nobody has
* complained, it seems rational to tighten up that
* restriction.
*/
if (result < DHCP_FIXED_NON_UDP)
return ISC_R_UNEXPECTED; return ISC_R_UNEXPECTED;
#if defined(IP_PKTINFO) && defined(IP_RECVPKTINFO) && defined(USE_V4_PKTINFO) #if defined(IP_PKTINFO) && defined(IP_RECVPKTINFO) && defined(USE_V4_PKTINFO)

6
common/options.c
View File

@ -3,7 +3,7 @@
DHCP options parsing and reassembly. */ DHCP options parsing and reassembly. */
/* /*
* Copyright (c) 2004-2010 by Internet Systems Consortium, Inc. ("ISC") * Copyright (c) 2004-2011 by Internet Systems Consortium, Inc. ("ISC")
* Copyright (c) 1995-2003 by Internet Software Consortium * Copyright (c) 1995-2003 by Internet Software Consortium
* *
* Permission to use, copy, modify, and distribute this software for any * Permission to use, copy, modify, and distribute this software for any
@ -592,8 +592,8 @@ cons_options(struct packet *inpacket, struct dhcp_packet *outpacket,
} else if (bootpp) { } else if (bootpp) {
mb_size = 64; mb_size = 64;
if (inpacket != NULL && if (inpacket != NULL &&
(inpacket->packet_length - DHCP_FIXED_LEN >= 64)) (inpacket->packet_length >= 64 + DHCP_FIXED_NON_UDP))
mb_size = inpacket->packet_length - DHCP_FIXED_LEN; mb_size = inpacket->packet_length - DHCP_FIXED_NON_UDP;
} else } else
mb_size = DHCP_MIN_OPTION_LEN; mb_size = DHCP_MIN_OPTION_LEN;

2
server/dhcp.c
View File

@ -2354,6 +2354,7 @@ void ack_lease (packet, lease, offer, when, msg, ms_nulltp, hp)
* giaddr. * giaddr.
*/ */
if (!packet->agent_options_stashed && if (!packet->agent_options_stashed &&
(packet->options != NULL) &&
packet->options->universe_count > agent_universe.index && packet->options->universe_count > agent_universe.index &&
packet->options->universes[agent_universe.index] != NULL) { packet->options->universes[agent_universe.index] != NULL) {
oc = lookup_option (&server_universe, state -> options, oc = lookup_option (&server_universe, state -> options,
@ -4506,6 +4507,7 @@ maybe_return_agent_options(struct packet *packet, struct option_state *options)
* by the user into the new state, not just give up. * by the user into the new state, not just give up.
*/ */
if (!packet->agent_options_stashed && if (!packet->agent_options_stashed &&
(packet->options != NULL) &&
packet->options->universe_count > agent_universe.index && packet->options->universe_count > agent_universe.index &&
packet->options->universes[agent_universe.index] != NULL && packet->options->universes[agent_universe.index] != NULL &&
(options->universe_count <= agent_universe.index || (options->universe_count <= agent_universe.index ||