Note: This is an archival copy of Security Sun Alert 243806 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019687.1.
Solaris 8 Operating System
Solaris 9 Operating System
Solaris 10 Operating System
Date of Resolved Release
Security Vulnerabilities in DHCP Handling of DHCP Requests May Allow Remote Users to Execute Arbitrary Code or Cause a Denial of the DHCP Service
Security vulnerabilities in the DHCP (in.dhcpd(1M)) server handling of DHCP requests may allow a remote unprivileged user to kill the DHCP server daemon (Denial of Service) or to execute arbitrary code as the root user.
One of the issues described here is also referenced in the following document:
CVE-2007-5365 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5365
2. Contributing Factors
These issues can occur in the following releases:
1. Only OpenSolaris installations which include the affected binary /usr/lib/inet/in.dhcpd and have the DHCP server configured and running are impacted by this issue.
2. OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. The base build can be derived as follows:
$ uname -v
3. Only systems which are configured as a DHCP server are impacted by this issue. To determine if a system is configured as a DHCP server, the following command can be run.
$ svcs svc:/network/dhcp-server:default
If the output shows the state is online, then the system is configured as a DHCP server.
The security vulnerability which allows arbitrary code executio, has no reliable symptoms that would indicate the issue has been exploited.
The security vulnerability which allows a denial of of teh DHCP service will result in the DHCP server daemon exiting with an "Assertion failed" error message.
There are no workarounds for these issues. Please see the Resolution section below.
These issues are addressed in the following releases:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
This solution has no attachment