DHCP: Denial of Service -- Remote/Unauthenticated

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0610
 CVE-2016-2774: An attacker who is allowed to connect to DHCP inter-server
     communications and control channels can exhaust server resources
                               8 March 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           DHCP
Publisher:         ISC
Operating System:  Windows
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-2774  

Original Bulletin: 
   https://kb.isc.org/article/AA-01354

- --------------------------BEGIN INCLUDED TEXT--------------------

CVE-2016-2774: An attacker who is allowed to connect to DHCP inter-server 
communications and control channels can exhaust server resources

Author: Michael McNally 

Reference Number: AA-01354 

Views: 156 

Created: 2016-03-07 11:34 

Last Updated: 2016-03-08 00:31 

CVE: CVE-2016-2774

Document Version: 2.0

Posting date: 07 March 2016

Program Impacted:

ISC DHCP

Versions affected: 4.1.0->4.1-ESV-R12-P1, 4.2.0->4.2.8, 4.3.0->4.3.3-P1. Older
versions may also be affected but are well beyond their end-of-life (EOL). 
Releases prior to 4.1.0 have not been tested.

Severity:

Medium

Exploitable: Remotely, if remote network connections to the DHCP server's 
control ports (e.g. OMAPI and failover) are permitted.

Description:

In many cases, the ISC DHCP server does not effectively limit the number of 
simultaneous open TCP connections to the ports the server uses for 
inter-process communications and control. Because of this, a malicious party 
could interfere with server operation by opening (and never closing) a large 
number of TCP connections to the server.

Impact:

By exploiting this vulnerability an attacker can interfere with DHCP server 
operation. Exact results are difficult to summarize concisely because the 
effect of an attack varies depending on server version, the channel being 
attacked, and in some operating systems on environment settings inherited from
the launching shell (e.g. "ulimit" settings on per-process open file 
descriptors) but depending on the combination potential undesirable outcomes 
include (but are not necessarily limited to):

The server may deliberately exit after encountering an INSIST failure (server
version dependent).

The server may become unresponsive and stop answering client requests.

The server may continue operating but not be able to accept further 
connections from OMAPI clients or failover peers.

If no limits are inherited from the environment, the server may consume all 
available sockets, potentially interfering with other services running on the
same machine.

Risk of exploitation is highest on the OMAPI port (if OMAPI is configured). 
The failover code will close incoming connections if they are not received 
from a peer (making it more difficult but not impossible to attack a server 
using failover channels). OMAPI, however, has no logic in the server limiting
addresses from which it will accept connections. A firewall is recommended as
an industry-standard precaution against accepting connections from untrusted 
hosts.

CVSS Score: 5.7

CVSS Vector: (AV:A/AC:M/Au:N/C:N/I:N/A:C)

For more information on the Common Vulnerability Scoring System and to obtain
your specific environmental score please visit: 
http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2&vector=(AV:A/AC:M/Au:N/C:N/I:N/A:C)

Workarounds:

ISC recommends that server operators restrict the hosts allowed to make 
connections to DHCP server inter-process communication channels to trusted 
hosts, blocking connections to the OMAPI control port and the failover 
communications ports from all other hosts.

If OMAPI and/or failover are not being actively used, they can be disabled. 
The ISC Knowledge Base contains some information that operators may find 
relevant:

https://kb.isc.org/article/AA-01355/56/Securing-dhcpd-against-unauthorised-OMAPI-control-connections.html

https://kb.isc.org/article/AA-01356/56/What-is-DHCP-Failover.html

https://kb.isc.org/article/AA-00502/31/A-Basic-Guide-to-Configuring-DHCP-Failover.html

Additionally, in environments where per-process file descriptor limits can be
inherited from the shell used to launch dhcpd, using ulimit to set a 
reasonable limit on simultaneous socket connections can prevent the INSIST 
assertion failure outcome but may still allow interference with legitimate 
interprocess communication traffic.

Active exploits:

No known active exploits, but a public mention of the issue has occurred on an
open mailing list.

Solution:

Mitigation code which will make this vulnerability harder to exploit will be 
added to the upcoming DHCP maintenance releases (DHCP 4.1-ESV-R13, DHCP 4.3.4,
due to be released in March 2016.)

However, the strategies described in the "Workarounds" section of this 
document are effective and can prevent exploitation of the vulnerability. 
Unless server operators have identified operational needs unique to their 
environment which conflict with this advice, ISC recommends blocking incoming
TCP connections from untrusted hosts as a preferred strategy.

Acknowledgements: ISC would like to thank Konstantin Orekhov for discovering 
this vulnerability.

Document Revision History:

1.0 Advance Notification 04 March 2016

2.0 Public Disclosure 07 March 2016

If you'd like more information on ISC Subscription Support and Advance 
Security Notifications, please visit http://www.isc.org/support/.

Do you still have questions? Questions regarding this advisory should go to 
security-officer@isc.org. To report a new issue, please encrypt your message 
using security-officer@isc.org's PGP key which can be found here: 
https://www.isc.org/downloads/software-support-policy/openpgp-key/. If you are
unable to use encrypted email, you may also report new issues at: 
https://www.isc.org/community/report-bug/.

Note: ISC patches only currently supported versions. When possible we indicate
EOL versions affected. (For current information on which versions are actively
supported, please see http://www.isc.org/downloads/).

ISC Security Vulnerability Disclosure Policy: Details of our current security
advisory policy and practice can be found here: 
https://kb.isc.org/article/AA-00861/164/ISC-Software-Defect-and-Security-Vulnerability-Disclosure-Policy.html

This Knowledge Base article https://kb.isc.org/article/AA-01354 is the 
complete and official security advisory document.

Legal Disclaimer:

Internet Systems Consortium (ISC) is providing this notice on an "AS IS" 
basis. No warranty or guarantee of any kind is expressed in this notice and 
none should be implied. ISC expressly excludes and disclaims any warranties 
regarding this notice or materials referred to in this notice, including, 
without limitation, any implied warranty of merchantability, fitness for a 
particular purpose, absence of hidden defects, or of non-infringement. Your 
use or reliance on this notice or materials referred to in this notice is at 
your own risk. ISC may change this notice at any time. A stand-alone copy or 
paraphrase of the text of this document that omits the document URL is an 
uncontrolled copy. Uncontrolled copies may lack important information, be out
of date, or contain factual errors.

 2001-2016 Internet Systems Consortium

Please help us to improve the content of our knowledge base by letting us know
below how we can improve this article.

If you have a technical question or problem on which you'd like help, please 
don't submit it here as article feedback.

For assistance with problems and questions for which you have not been able to
find an answer in our Knowledge Base, we recommend searching our community 
mailing list archives and/or posting your question there (you will need to 
register there first for your posts to be accepted). The bind-users and the 
dhcp-users lists particularly have a long-standing and active membership.

ISC relies on the financial support of the community to fund the development 
of its open source software products. If you would like to support future 
product evolution and maintenance as well having peace of mind knowing that 
our team of experts are poised to provide you with individual technical 
assistance whenever you call upon them, then please consider our Professional
Subscription Support services - details can be found on our main website.

Feedback

There is no feedback for this article

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVt5AuX6ZAP0PgtI9AQKm4BAAz+y/EMNGHShEu94x/rpFQ8JkDDvK810u
tl0D6RuNjV8FHbtjNLnyBwNsXnSQ+Gl79setgYxNy+1dPmr+UKBFge4iMIYZ+dDp
8RcnZxL1a6W9i+kVTM6Nb+4Gxa+7Bz95iH7twaGF4a8OQMLQf/4J9sZkcWTW4l8V
4OWgwiuSZBieoG1oq/VsbErnh2hv0c//b5Kn2PZF0FxGX1xhJ/oFCpqurGbPBnM2
oYaZa//ByYnFm4/ovufXYPb4/5oMEMD6VKmSFbi4ztjJFupFNzIY63XrzMLlLs75
dCiARqyY0inJvRvnNTlmBN3Rimrkb0VdpolWAcQsE/a2ZndS/WnxzTkQum2s89B8
BsTj1d0RgFMjUms826N9g/OVUUo/JcZ8u91QAOUJQtN1xbjN8gJGOpyvADgItyuH
XrH0PG7YS4nSAE+g5qrH/zTIWWhuhtOqikVXmyCYFO74z7CeUdwj7POmJYZFf3zd
bMDKCgjo9abgU+xtyqNtcuu7nOF5fv1VrDtCop9+dqA71kZYiKccS7BiSCLFDHmS
oN6tI/iv8F3gICoGqs+1FAVuS/7Aj+42nz7Qzaa4OquTT7qg1WxT4P1g3bZ0htDC
34rbU9AXVblobMduOLb7aC9xbDWEPTjUdxZRd/uOa9ZCbYoN/LuxhlCRAKLKL/FS
5TOxqFiujxU=
=xYiL
-----END PGP SIGNATURE-----