oss-sec mailing list archives
Re: ISC DHCP client and unsolicited DHCP options
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 17 Jul 2013 22:35:52 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/17/2013 01:21 PM, Florian Weimer wrote:
Somewhat surprisingly, ISC DHCP does not check if a server response contains options which have not been requested. As a result, removing items from dhclient.conf (say, DNS servers or route requests) does not provide any additional security. This is not a CVE assignment request. I just want to share this to give distributions the opportunity to update their configuration scripts (the actual interface configuration is implemented in shell, in case you wonder). Upstream version 4.2.5 adds additional environment variables which allow the script to check what was requested in dhclient.conf: | - The client now passes information about the options it requested | from the server to the script code via environment variables. | These variables are of the form requested_<option_name>=1 with | the option name being the same as used in the new_* and old_* | variables. | [ISC-Bugs #29068] (Using NetworkManager may still bypass dhclient.conf settings, see Debian bug 717158.)
Do any DHCP clients process and use options passed to them that are not explicitly wanted? Might be worth setting up a DHCP server that hands out every possible options (there's a lot) and see what happens on various clients. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJR53CoAAoJEBYNRVNeJnmTGw0P/ifiXZNt56f0JaBOaq4J3ZOM xQICpvZiOJ5meCYyVwJHxB3Ket4GXxEjLlwFi4RTWc5So5tlH9diINQq4q1oeUHF ajOs2vb0dXA7bxUOaug2BU+35GQYncQ9ns4XcP0U0aMP23z7JAolXcwkELM3TN3p kQICLwdcPK/x9zT8avmX37LTE41N0zSltxVRxw60iTy1QyHwlFVP+VG8VHNKeu+i 20zUsVpMUajhwzOm1xnzvJIjSdlZrVBMcLNorFRlbDkqKZpwAd50IfSAvGmcbpfu JlZUn+xJfGLSNhjx7TvbuLAaADUUH0ZVOYkHvkFGp4wPvYpwLnDMkWUiN+TdUyD2 rKQa5SEDIQ45YeZLhAIwAimabQdMUOYLnCQXMlWlryJK4Oog3X8eBaQMwKuxlMfm 6pbSrBrfdfhPwFjLaUXEQCwHb4IKNDp3pH32/WyDuo49D7q0iRAQrZg3gQ0N0cg7 Ua9YtUt5FJNqkDE7M26ANjrgPCONHgqOXvvH1qAWvTiNpxDtKwwOykwVAYQ4yAcP A3wvmJ5WsUj6o10toTfuNrlZzj37eqY1ppiyd9e9J36fQ82Tl2FkQcWTJhDxu3Dc ah6ymoXURH/d2JdTHdUvIgBFoRjHmZNWSMzPjt/50p5RdhfP/jgujlO5g6Me4KTa lLAMAGNWCipXHmCCGamO =LDL/ -----END PGP SIGNATURE-----
Current thread:
- ISC DHCP client and unsolicited DHCP options Florian Weimer (Jul 17)
- Re: ISC DHCP client and unsolicited DHCP options Kurt Seifried (Jul 17)
- Re: ISC DHCP client and unsolicited DHCP options Helmut Grohne (Jul 28)
- Re: ISC DHCP client and unsolicited DHCP options Tomas Hoger (Aug 13)
- Re: ISC DHCP client and unsolicited DHCP options Helmut Grohne (Jul 28)
- Re: ISC DHCP client and unsolicited DHCP options Kurt Seifried (Jul 17)