=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2011/VULN058
_____________________________________________________________________

DATE                      : 27/01/2011

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running DHCP versions 4.0.x, 4.1.x, 4.2.x.

======================================================================
http://www.isc.org/software/dhcp/advisories/cve-2011-0413
______________________________________________________________________

Title: DHCP May Crash After Processing a DHCPv6 Decline Message

CVE# 2011-0413

VU# 686084

CVSS: 6.2

Posting date: 2011-01-21 (Advanced notice)

Program Impacted: DHCP

Versions affected: 4.0.x-4.2.x

Severity: moderate

Exploitable: remotely

Description and Impact:

When the DHCPv6 server code processes a message for an address that was
previously declined and internally tagged as abandoned it can trigger an
assert failure resulting in the server crashing. This could be used to
crash DHCPv6 servers remotely. This issue only affects DHCPv6 servers.
DHCPv4 servers are unaffected.

Workarounds: No direct workaround.

Exposure to the vulnerability can be limited by a review of the filters
and access to the DHCP server. It is highly recommended to limit access
to those devices which require DHCP server, management access, and
systems monitoring.

Active exploits: None known.

Solution: Upgrade to 4.1.2-P1, 4.1-ESV-R1, or 4.2.1b1.

Questions regarding this advisory or ISC's Support services should be
sent to dhcp-bugs@isc.org

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================