Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: ISC DHCP client and unsolicited DHCP options
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 17 Jul 2013 22:35:52 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/17/2013 01:21 PM, Florian Weimer wrote:
Somewhat surprisingly, ISC DHCP does not check if a server
response contains options which have not been requested.  As a
result, removing items from dhclient.conf (say, DNS servers or
route requests) does not provide any additional security.

This is not a CVE assignment request.  I just want to share this
to give distributions the opportunity to update their
configuration scripts (the actual interface configuration is
implemented in shell, in case you wonder).  Upstream version 4.2.5
adds additional environment variables which allow the script to
check what was requested in dhclient.conf:

| - The client now passes information about the options it
requested |   from the server to the script code via environment
variables. |   These variables are of the form
requested_<option_name>=1 with |   the option name being the same
as used in the new_* and old_* |   variables. |   [ISC-Bugs
#29068]

(Using NetworkManager may still bypass dhclient.conf settings, see 
Debian bug 717158.)


Do any DHCP clients process and use options passed to them that are
not explicitly wanted? Might be worth setting up a DHCP server that
hands out every possible options (there's a lot) and see what happens
on various clients.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJR53CoAAoJEBYNRVNeJnmTGw0P/ifiXZNt56f0JaBOaq4J3ZOM
xQICpvZiOJ5meCYyVwJHxB3Ket4GXxEjLlwFi4RTWc5So5tlH9diINQq4q1oeUHF
ajOs2vb0dXA7bxUOaug2BU+35GQYncQ9ns4XcP0U0aMP23z7JAolXcwkELM3TN3p
kQICLwdcPK/x9zT8avmX37LTE41N0zSltxVRxw60iTy1QyHwlFVP+VG8VHNKeu+i
20zUsVpMUajhwzOm1xnzvJIjSdlZrVBMcLNorFRlbDkqKZpwAd50IfSAvGmcbpfu
JlZUn+xJfGLSNhjx7TvbuLAaADUUH0ZVOYkHvkFGp4wPvYpwLnDMkWUiN+TdUyD2
rKQa5SEDIQ45YeZLhAIwAimabQdMUOYLnCQXMlWlryJK4Oog3X8eBaQMwKuxlMfm
6pbSrBrfdfhPwFjLaUXEQCwHb4IKNDp3pH32/WyDuo49D7q0iRAQrZg3gQ0N0cg7
Ua9YtUt5FJNqkDE7M26ANjrgPCONHgqOXvvH1qAWvTiNpxDtKwwOykwVAYQ4yAcP
A3wvmJ5WsUj6o10toTfuNrlZzj37eqY1ppiyd9e9J36fQ82Tl2FkQcWTJhDxu3Dc
ah6ymoXURH/d2JdTHdUvIgBFoRjHmZNWSMzPjt/50p5RdhfP/jgujlO5g6Me4KTa
lLAMAGNWCipXHmCCGamO
=LDL/
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault