oss-security - ISC DHCP CVE-2015-8605: UDP payload length not properly checked

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <56957991.40706@isc.org>
Date: Tue, 12 Jan 2016 16:09:21 -0600
From: ISC Security Officer <security-officer@....org>
To: oss-security@...ts.openwall.com
Cc: ISC Security Officer <security-officer@....org>
Subject: ISC DHCP CVE-2015-8605: UDP payload length not properly checked

Please be advised that ISC publicly announced a vulnerability in the
DHCP software.

CVE-2015-8605 is a denial-of-service vector which can potentially be
exploited against ISC DHCP servers, clients, and relays.  All prior 4.x
releases of ISC DHCP are vulnerable.  Additionally, ISC DHCP 3.x may
also be vulnerable, but no testing has been done.

New releases of ISC DHCP, including security fixes for this
vulnerability, are available at: www.isc.org/downloads/

Release notes can be obtained using the following links:

ftp://ftp.isc.org/isc/dhcp/4.3.3-P1/dhcp-4.3.3-P1-RELNOTES
ftp://ftp.isc.org/isc/dhcp/4.1-ESV-R12-P1/dhcp-4.1-ESV-R12-P1-RELNOTES

-- 
Brian Conry
ISC Support
Acting Security Officer

Download attachment "signature.asc" of type "application/pgp-signature" (456 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.