3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
125 lines
4.8 KiB
Text
125 lines
4.8 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-00:34 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: dhclient vulnerable to malicious dhcp server
|
|
|
|
Category: core, ports
|
|
Module: dhclient, isc-dhcp2 (ports), isc-dhcp3 (ports)
|
|
Announced: 2000-08-14
|
|
Affects: All releases of FreeBSD after FreeBSD 3.2-RELEASE and
|
|
prior to the correction date (including FreeBSD 4.0
|
|
and 3.5, but not 4.1)
|
|
Ports collection prior to the correction date.
|
|
Credits: OpenBSD
|
|
Vendor status: Updated version released
|
|
Corrected: 2000-07-20 [FreeBSD 4.0 base system]
|
|
2000-08-01 [isc-dhcp2 port]
|
|
2000-07-21 [isc-dhcp3 port]
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
ISC-DHCP is an implementation of the DHCP protocol containing client
|
|
and server. FreeBSD 3.2 and above includes the version 2 client by
|
|
default in the base system, and the version 2 and version 3 clients
|
|
and servers in the Ports Collection.
|
|
|
|
II. Problem Description
|
|
|
|
The dhclient utility (DHCP client), versions 2.0pl2 and before (for
|
|
the version 2.x series), and versions 3.0b1pl16 and before (for the
|
|
version 3.x series) does not correctly validate input from the server,
|
|
allowing a malicious DHCP server to execute arbitrary commands as root
|
|
on the client. DHCP may be enabled if your system was initially
|
|
configured from a DHCP server at install-time, or if you have
|
|
specifically enabled it after installation.
|
|
|
|
FreeBSD 4.1 is not affected by this problem since it contains the
|
|
2.0pl3 client.
|
|
|
|
III. Impact
|
|
|
|
An attacker who has or gains control of a DHCP server may gain
|
|
additional root access to DHCP clients running vulnerable versions of
|
|
ISC-DHCP.
|
|
|
|
If you are not using dhclient to configure client machines via DHCP,
|
|
or your DHCP server is "trusted" according to your local security
|
|
policy, then this vulnerability does not apply to you.
|
|
|
|
IV. Workaround
|
|
|
|
Disable the use of DHCP for configuring client machines: remove the
|
|
case-insensitive string "dhcp" from the "ifconfig_<foo>" directives in
|
|
/etc/rc.conf and replace it with appropriate static interface
|
|
configuration according to the rc.conf(5) manpage.
|
|
|
|
An example of a DHCP-enabled interface is the following line in
|
|
/etc/rc.conf:
|
|
|
|
ifconfig_xl0="DHCP"
|
|
|
|
V. Solution
|
|
|
|
NOTE: At this time the FreeBSD 3.x branch has not yet been patched,
|
|
due to logistical difficulties. Users running a vulnerable 3.x system
|
|
are advised to either upgrade to FreeBSD 4.1, disable the use of
|
|
DHCP as described above, or use the dhclient binary from the isc-dhcp2
|
|
port dated after the correction date.
|
|
|
|
1) Upgrade your vulnerable FreeBSD 4.0 system to a version dated after the
|
|
correction date. See
|
|
|
|
http://www.freebsd.org/handbook/makeworld.html
|
|
|
|
for instructions on how to upgrade and recompile your FreeBSD system
|
|
from source, or perform a binary upgrade, e.g. to FreeBSD 4.1-RELEASE,
|
|
described here:
|
|
|
|
http://www.freebsd.org/releases/4.1R/notes.html
|
|
|
|
2) (If using the isc-dhcp2 or isc-dhcp3 ports) One of the following:
|
|
|
|
2a) Upgrade your entire ports collection and rebuild the isc-dhcp2 or isc-dhcp3 port.
|
|
|
|
2b) Deinstall the old package and install a new package dated after the
|
|
correction date, obtained from:
|
|
|
|
[isc-dhcp3]
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/net/isc-dhcp3-3.0.b1.17.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/isc-dhcp3-3.0.b1.17.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/net/isc-dhcp3-3.0.b1.17.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/isc-dhcp3-3.0.b1.17.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/net/isc-dhcp3-3.0.b1.17.tgz
|
|
|
|
NOTE: The isc-dhcp2 port is not available as a package.
|
|
|
|
2c) download a new port skeleton for the isc-dhcp2 or isc-dhcp3 port from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
2d) Use the portcheckout utility to automate option (3) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBOZh3J1UuHi5z0oilAQHXBQQAmCLlTUfikHbgBelFd22agjTo/AVwR933
|
|
El0AMRHakiBJAHTMseZ4Nj+HyGUgVzD3oRMgmjx1u+HUCQM2/akuXXZdSHlur5Jc
|
|
OyEGxcwxyzYXnNzWAL1vh6MYrpkGDfh74bHircLdO16d6uC1d+0VFmkxUOOFN4zb
|
|
g7yK3m2ZOxo=
|
|
=qTwd
|
|
-----END PGP SIGNATURE-----
|