Date: Wed, 17 Jul 2013 21:21:53 +0200 From: Florian Weimer <fw@...eb.enyo.de> To: oss-security@...ts.openwall.com Subject: ISC DHCP client and unsolicited DHCP options Somewhat surprisingly, ISC DHCP does not check if a server response contains options which have not been requested. As a result, removing items from dhclient.conf (say, DNS servers or route requests) does not provide any additional security. This is not a CVE assignment request. I just want to share this to give distributions the opportunity to update their configuration scripts (the actual interface configuration is implemented in shell, in case you wonder). Upstream version 4.2.5 adds additional environment variables which allow the script to check what was requested in dhclient.conf: | - The client now passes information about the options it requested | from the server to the script code via environment variables. | These variables are of the form requested_<option_name>=1 with | the option name being the same as used in the new_* and old_* | variables. | [ISC-Bugs #29068] (Using NetworkManager may still bypass dhclient.conf settings, see Debian bug 717158.)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.