Denial of Service in ISC DHCP
Summary
CVE-2011-4539: dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted requ... Affects isc-dhcp versions < 4.2.2.dfsg.1-5. Fixed in 4.2.2.dfsg.1-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ISC DHCP is an open-source implementation of the Dynamic Host Configuration Protocol (DHCP) server and client. It provides automatic IP address assignment and configuration information to devices on a network. The vulnerability, identified as CVE-2011-4539, affects ISC DHCP versions 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4. It arises from a flaw in the handling of regular expressions in the dhcpd.conf file, which can be exploited by remote attackers to cause a denial of service (daemon crash) by sending a specially crafted request packet.
Vulnerability Detail
The vulnerability in ISC DHCP arises due to improper handling of regular expressions in the dhcpd.conf file. By sending a specially crafted request packet, remote attackers can trigger a daemon crash, resulting in a denial of service. This vulnerability can be exploited remotely without requiring any authentication. The impact of this vulnerability is limited to crashing the DHCP daemon, which may disrupt network services until the daemon is restarted.
How To Fix
Minimum fixed version
4.2.2.dfsg.1-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade isc-dhcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can modify the dhcpd.conf file to avoid using regular expressions in a way that triggers the vulnerability. This may involve removing or modifying any regular expressions that could potentially be exploited. However, it is strongly recommended to apply the official patch or upgrade to a fixed version rather than relying on workarounds, as they may not provide complete protection.
Conclusion
The vulnerability in ISC DHCP allows remote attackers to cause a denial of service by crashing the DHCP daemon. To mitigate this vulnerability, it is crucial to upgrade to the patched versions or apply the official patch provided by ISC. Users should also ensure the DHCP daemon is restarted after the update. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for isc-dhcp →
FAQ
ISC DHCP is an open-source implementation of the Dynamic Host Configuration Protocol (DHCP) server and client. It is widely used for automatic IP address assignment and network configuration.
The vulnerability allows remote attackers to crash the DHCP daemon, resulting in a denial of service. However, it does not provide unauthorized access or allow arbitrary code execution.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze and alert you if the vulnerability is present.
Yes, users can modify the dhcpd.conf file to avoid using regular expressions in a way that triggers the vulnerability. However, it is recommended to apply the official patch or upgrade to a fixed version for complete protection.
The official patches and fixed versions can be obtained from the official ISC DHCP website (https://www.isc.org/dhcp/) or through the package repositories of your operating system.
References
Related vulnerabilities
Recent vulnerabilities recorded for isc-dhcp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.