[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <51E770A8.5090504@redhat.com>
Date: Wed, 17 Jul 2013 22:35:52 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Florian Weimer <fw@...eb.enyo.de>
Subject: Re: ISC DHCP client and unsolicited DHCP options
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/17/2013 01:21 PM, Florian Weimer wrote:
> Somewhat surprisingly, ISC DHCP does not check if a server
> response contains options which have not been requested. As a
> result, removing items from dhclient.conf (say, DNS servers or
> route requests) does not provide any additional security.
>
> This is not a CVE assignment request. I just want to share this
> to give distributions the opportunity to update their
> configuration scripts (the actual interface configuration is
> implemented in shell, in case you wonder). Upstream version 4.2.5
> adds additional environment variables which allow the script to
> check what was requested in dhclient.conf:
>
> | - The client now passes information about the options it
> requested | from the server to the script code via environment
> variables. | These variables are of the form
> requested_<option_name>=1 with | the option name being the same
> as used in the new_* and old_* | variables. | [ISC-Bugs
> #29068]
>
> (Using NetworkManager may still bypass dhclient.conf settings, see
> Debian bug 717158.)
>
Do any DHCP clients process and use options passed to them that are
not explicitly wanted? Might be worth setting up a DHCP server that
hands out every possible options (there's a lot) and see what happens
on various clients.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJR53CoAAoJEBYNRVNeJnmTGw0P/ifiXZNt56f0JaBOaq4J3ZOM
xQICpvZiOJ5meCYyVwJHxB3Ket4GXxEjLlwFi4RTWc5So5tlH9diINQq4q1oeUHF
ajOs2vb0dXA7bxUOaug2BU+35GQYncQ9ns4XcP0U0aMP23z7JAolXcwkELM3TN3p
kQICLwdcPK/x9zT8avmX37LTE41N0zSltxVRxw60iTy1QyHwlFVP+VG8VHNKeu+i
20zUsVpMUajhwzOm1xnzvJIjSdlZrVBMcLNorFRlbDkqKZpwAd50IfSAvGmcbpfu
JlZUn+xJfGLSNhjx7TvbuLAaADUUH0ZVOYkHvkFGp4wPvYpwLnDMkWUiN+TdUyD2
rKQa5SEDIQ45YeZLhAIwAimabQdMUOYLnCQXMlWlryJK4Oog3X8eBaQMwKuxlMfm
6pbSrBrfdfhPwFjLaUXEQCwHb4IKNDp3pH32/WyDuo49D7q0iRAQrZg3gQ0N0cg7
Ua9YtUt5FJNqkDE7M26ANjrgPCONHgqOXvvH1qAWvTiNpxDtKwwOykwVAYQ4yAcP
A3wvmJ5WsUj6o10toTfuNrlZzj37eqY1ppiyd9e9J36fQ82Tl2FkQcWTJhDxu3Dc
ah6ymoXURH/d2JdTHdUvIgBFoRjHmZNWSMzPjt/50p5RdhfP/jgujlO5g6Me4KTa
lLAMAGNWCipXHmCCGamO
=LDL/
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
