ISC, the Internet Systems Consortium, has fixed a flaw in its DHCP software stack that would allow an attacker to crash DHCP clients, servers, and relays.
The DHCP (Dynamic Host Configuration Protocol) protocol allows a device to request and obtain an IP address from a local server. The protocol is one of the cornerstones of the Internet and is vital to modern Internet-connected equipment, allowing it to dynamically connect to servers without having to manually set an IP address when configuring each device.
The protocol relies on devices that need to connect to the Internet through special software packages. One of the most widely used software packages that provide DHCP support is the ISC DHCP implementation.
Sophos security researchers recently discovered a flaw affecting all versions of the ISC DHCP package, which can crash it by sending it a malicious network packet with an invalid IPv4 UDP length field.
All DHCP servers, clients, and relays are affected, except those configured to operate in unicast mode only. While DHCP most of the time operates in unicast mode only, the initial DHCP client-server negotiations are always done via multicast messages. This means that very few machines (except with special network configurations) are set up to operate exclusively in unicast mode and are therefore vulnerable to these attacks.
The purpose of crashing a DHCP client can be to isolate a machine from its original network or, if the server is the target, to crash the LAN network among various attack scenarios.
The ISC says that there is no mitigation technique that can be implemented to prevent these types of attacks and that the only way for users to protect themselves is to implement the latest version of the DHCP package.
To fix this vulnerability (CVE-2015-8605), ISC has released versions 4.1-ESV-R12-P1 and 4.3.3-P1 of its DHCP package.
