[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080708163725.GF7051@severus.strandboge.com>
Date: Tue, 8 Jul 2008 12:37:25 -0400
From: Jamie Strandboge <jamie@...onical.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE request for dnsmasq DoS
On Thu, 03 Jul 2008, Jamie Strandboge wrote:
> On Tue, 01 Jul 2008, Steven M. Christey wrote:
> > On Mon, 30 Jun 2008, Jamie Strandboge wrote:
> >
> > > There is a remote DoS in dnsmasq 2.25 (and presumably earlier) that is
> > > fixed in 2.26. Details can be found at [1]. Can we get a CVE assigned
> > > for this?
> >
> > I'm not sure I fully understand Thierry Carrez' comment about the security
> > implications of this issue. It seems like an exploit would require a
> > malicious DHCP server, in which case isn't DHCP service already
> > compromised? If so, then a crash of dnsmasq (null dereference?) doesn't
> > seem to be any worse than the loss of DHCP itself.
> >
> I haven't had time to develop a PoC, but from the dnsmasq 2.26 announce
> page at [1], a client need only send a crafted renewal request to crash
> the server. Thierry's comments were only for trying to reproduce the
> problem and test the patch.
>
I finally had time to develop a PoC and confirm this on my own. A client
need only send a DHCPREQUEST for an IP address not on the same network
as dnsmasq. Eg:
1. dnsmasq listening on and giving IP addresses for 192.168.122.0/24
2. client requests IP address on another network, such as 192.168.0.1
3. dnsmasq 2.25 (and presumably earlier) crashes
This can happen in normal operation with roaming users, but can also
happen with a malicious request. Attached is a script to easily test for
this (requires python scapy).
Jamie
--
Ubuntu Security Engineer | http://www.ubuntu.com/
Canonical Ltd. | http://www.canonical.com/
View attachment "dhcp_request.py" of type "text/x-python" (1928 bytes)
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
