[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Jul 2013 21:21:53 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: ISC DHCP client and unsolicited DHCP options
Somewhat surprisingly, ISC DHCP does not check if a server response
contains options which have not been requested. As a result, removing
items from dhclient.conf (say, DNS servers or route requests) does not
provide any additional security.
This is not a CVE assignment request. I just want to share this to
give distributions the opportunity to update their configuration
scripts (the actual interface configuration is implemented in shell,
in case you wonder). Upstream version 4.2.5 adds additional
environment variables which allow the script to check what was
requested in dhclient.conf:
| - The client now passes information about the options it requested
| from the server to the script code via environment variables.
| These variables are of the form requested_<option_name>=1 with
| the option name being the same as used in the new_* and old_*
| variables.
| [ISC-Bugs #29068]
(Using NetworkManager may still bypass dhclient.conf settings, see
Debian bug 717158.)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
