ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dhcp | Isc | 4.1-esv (including) | 4.1-esv (including) |
| Dhcp | Isc | 4.1-esv-r1 (including) | 4.1-esv-r1 (including) |
| Dhcp | Isc | 4.1-esv-r2 (including) | 4.1-esv-r2 (including) |
| Dhcp | Isc | 4.1-esv-r3 (including) | 4.1-esv-r3 (including) |
| Dhcp | Isc | 4.1-esv-r3_b1 (including) | 4.1-esv-r3_b1 (including) |
| Dhcp | Isc | 4.1-esv-r4 (including) | 4.1-esv-r4 (including) |
| Dhcp | Isc | 4.1-esv-r5 (including) | 4.1-esv-r5 (including) |
| Dhcp | Isc | 4.1-esv-r5_b1 (including) | 4.1-esv-r5_b1 (including) |
| Dhcp | Isc | 4.1-esv-r5_rc1 (including) | 4.1-esv-r5_rc1 (including) |
| Dhcp | Isc | 4.1-esv-r5_rc2 (including) | 4.1-esv-r5_rc2 (including) |
| Dhcp | Isc | 4.1-esv-r6 (including) | 4.1-esv-r6 (including) |
| Dhcp | Isc | 4.1-esv-rc1 (including) | 4.1-esv-rc1 (including) |
| Dhcp | Isc | 4.1.0 (including) | 4.1.0 (including) |
| Dhcp | Isc | 4.1.0-a1 (including) | 4.1.0-a1 (including) |
| Dhcp | Isc | 4.1.0-a2 (including) | 4.1.0-a2 (including) |
| Dhcp | Isc | 4.1.0-b1 (including) | 4.1.0-b1 (including) |
| Dhcp | Isc | 4.1.1 (including) | 4.1.1 (including) |
| Dhcp | Isc | 4.1.1-b1 (including) | 4.1.1-b1 (including) |
| Dhcp | Isc | 4.1.1-b2 (including) | 4.1.1-b2 (including) |
| Dhcp | Isc | 4.1.1-b3 (including) | 4.1.1-b3 (including) |
| Dhcp | Isc | 4.1.1-rc1 (including) | 4.1.1-rc1 (including) |
| Dhcp | Isc | 4.1.2 (including) | 4.1.2 (including) |
| Dhcp | Isc | 4.1.2-b1 (including) | 4.1.2-b1 (including) |
| Dhcp | Isc | 4.1.2-p1 (including) | 4.1.2-p1 (including) |
| Dhcp | Isc | 4.1.2-rc1 (including) | 4.1.2-rc1 (including) |
| Red Hat Enterprise Linux 6 | RedHat | dhcp-12:4.1.1-34.P1.el6 | * |
| Isc-dhcp | Ubuntu | devel | * |
| Isc-dhcp | Ubuntu | natty | * |
| Isc-dhcp | Ubuntu | oneiric | * |
| Isc-dhcp | Ubuntu | precise | * |
| Isc-dhcp | Ubuntu | upstream | * |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/088882.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086992.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088220.html
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00088.html
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00103.html
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00105.html
- http://rhn.redhat.com/errata/RHSA-2013-0504.html
- http://secunia.com/advisories/51318
- http://security.gentoo.org/glsa/glsa-201301-06.xml
- http://www.debian.org/security/2012/dsa-2551
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:153
- http://www.securityfocus.com/bid/55530
- http://www.securitytracker.com/id?1027528
- http://www.ubuntu.com/usn/USN-1571-1
- https://blogs.oracle.com/sunsecurity/entry/cve_2012_3955_denial_of
- https://kb.isc.org/article/AA-00779
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/088882.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086992.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088220.html
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00088.html
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00103.html
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00105.html
- http://rhn.redhat.com/errata/RHSA-2013-0504.html
- http://secunia.com/advisories/51318
- http://security.gentoo.org/glsa/glsa-201301-06.xml
- http://www.debian.org/security/2012/dsa-2551
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:153
- http://www.securityfocus.com/bid/55530
- http://www.securitytracker.com/id?1027528
- http://www.ubuntu.com/usn/USN-1571-1
- https://blogs.oracle.com/sunsecurity/entry/cve_2012_3955_denial_of
- https://kb.isc.org/article/AA-00779