ignore security and it'll go away

Mandriva Linux Security Advisory 2012-116

Mandriva Linux Security Advisory 2012-116
Posted Jul 27, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-116 - An error in the handling of malformed client identifiers can cause a DHCP server running affected versions to enter a state where further client requests are not processed and the server process loops endlessly, consuming all available CPU cycles. Under normal circumstances this condition should not be triggered, but a non-conforming or malicious client could deliberately trigger it in a vulnerable server. In order to exploit this condition an attacker must be able to send requests to the DHCP server. Two memory leaks have been found and fixed in ISC DHCP. The updated packages have been patched to correct these issues.

tags | advisory, memory leak
systems | linux, mandriva
advisories | CVE-2012-3571, CVE-2012-3954
MD5 | 8b3cbe9c81ae315761885e0079613fc8

Mandriva Linux Security Advisory 2012-116

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2012:116
http://www.mandriva.com/security/
_______________________________________________________________________

Package : dhcp
Date : July 26, 2012
Affected: Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in ISC DHCP:

An error in the handling of malformed client identifiers can cause
a DHCP server running affected versions (see Impact) to enter a
state where further client requests are not processed and the server
process loops endlessly, consuming all available CPU cycles. Under
normal circumstances this condition should not be triggered, but a
non-conforming or malicious client could deliberately trigger it in
a vulnerable server. In order to exploit this condition an attacker
must be able to send requests to the DHCP server (CVE-2012-3571).

Two memory leaks have been found and fixed in ISC DHCP. Both are
reproducible when running in DHCPv6 mode (with the -6 command-line
argument.) The first leak is confirmed to only affect servers
operating in DHCPv6 mode, but based on initial code analysis the
second may theoretically affect DHCPv4 servers (though this has not
been demonstrated.) (CVE-2012-3954).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3571
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3954
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
98ba7b30258cfd06bc7a19bd4757a183 mes5/i586/dhcp-client-4.1.2-0.7mdvmes5.2.i586.rpm
331d5e2d556f3877f16173d13ec68b5f mes5/i586/dhcp-common-4.1.2-0.7mdvmes5.2.i586.rpm
1af957f584ba970e1842df8b292b9474 mes5/i586/dhcp-devel-4.1.2-0.7mdvmes5.2.i586.rpm
e6ee64358b5c5bca19e16e523a071711 mes5/i586/dhcp-doc-4.1.2-0.7mdvmes5.2.i586.rpm
39fb25199a18755c702a3e746b3bb8f4 mes5/i586/dhcp-relay-4.1.2-0.7mdvmes5.2.i586.rpm
f1da21f64e8867506447422ffd871195 mes5/i586/dhcp-server-4.1.2-0.7mdvmes5.2.i586.rpm
b1615f9c33a0cbb3e6e7e1e7ef04ee07 mes5/SRPMS/dhcp-4.1.2-0.7mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
fb2e6ba527910d8ef4dd1f7a48f30356 mes5/x86_64/dhcp-client-4.1.2-0.7mdvmes5.2.x86_64.rpm
cf5be061e3c8870e70a54df491a7b329 mes5/x86_64/dhcp-common-4.1.2-0.7mdvmes5.2.x86_64.rpm
3f20bd4ffd8855696f76876994c286d8 mes5/x86_64/dhcp-devel-4.1.2-0.7mdvmes5.2.x86_64.rpm
c4fa73d255e097277d501e2fd008c145 mes5/x86_64/dhcp-doc-4.1.2-0.7mdvmes5.2.x86_64.rpm
ddb661502b75f6e6b454e369719961f1 mes5/x86_64/dhcp-relay-4.1.2-0.7mdvmes5.2.x86_64.rpm
89911babd5524527358b41a787136450 mes5/x86_64/dhcp-server-4.1.2-0.7mdvmes5.2.x86_64.rpm
b1615f9c33a0cbb3e6e7e1e7ef04ee07 mes5/SRPMS/dhcp-4.1.2-0.7mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFQEVJymqjQ0CJFipgRAgZ/AJoDUR3yQZ+z5pywvEKKb3ZhsdnlwwCgjF1V
8RcyXB2jyJfp5uHmWRMZZPU=
=jLLd
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    6 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close