Date: Wed, 17 Jul 2013 22:35:52 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Florian Weimer <fw@...eb.enyo.de> Subject: Re: ISC DHCP client and unsolicited DHCP options -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/17/2013 01:21 PM, Florian Weimer wrote: > Somewhat surprisingly, ISC DHCP does not check if a server > response contains options which have not been requested. As a > result, removing items from dhclient.conf (say, DNS servers or > route requests) does not provide any additional security. > > This is not a CVE assignment request. I just want to share this > to give distributions the opportunity to update their > configuration scripts (the actual interface configuration is > implemented in shell, in case you wonder). Upstream version 4.2.5 > adds additional environment variables which allow the script to > check what was requested in dhclient.conf: > > | - The client now passes information about the options it > requested | from the server to the script code via environment > variables. | These variables are of the form > requested_<option_name>=1 with | the option name being the same > as used in the new_* and old_* | variables. | [ISC-Bugs > #29068] > > (Using NetworkManager may still bypass dhclient.conf settings, see > Debian bug 717158.) > Do any DHCP clients process and use options passed to them that are not explicitly wanted? Might be worth setting up a DHCP server that hands out every possible options (there's a lot) and see what happens on various clients. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJR53CoAAoJEBYNRVNeJnmTGw0P/ifiXZNt56f0JaBOaq4J3ZOM xQICpvZiOJ5meCYyVwJHxB3Ket4GXxEjLlwFi4RTWc5So5tlH9diINQq4q1oeUHF ajOs2vb0dXA7bxUOaug2BU+35GQYncQ9ns4XcP0U0aMP23z7JAolXcwkELM3TN3p kQICLwdcPK/x9zT8avmX37LTE41N0zSltxVRxw60iTy1QyHwlFVP+VG8VHNKeu+i 20zUsVpMUajhwzOm1xnzvJIjSdlZrVBMcLNorFRlbDkqKZpwAd50IfSAvGmcbpfu JlZUn+xJfGLSNhjx7TvbuLAaADUUH0ZVOYkHvkFGp4wPvYpwLnDMkWUiN+TdUyD2 rKQa5SEDIQ45YeZLhAIwAimabQdMUOYLnCQXMlWlryJK4Oog3X8eBaQMwKuxlMfm 6pbSrBrfdfhPwFjLaUXEQCwHb4IKNDp3pH32/WyDuo49D7q0iRAQrZg3gQ0N0cg7 Ua9YtUt5FJNqkDE7M26ANjrgPCONHgqOXvvH1qAWvTiNpxDtKwwOykwVAYQ4yAcP A3wvmJ5WsUj6o10toTfuNrlZzj37eqY1ppiyd9e9J36fQ82Tl2FkQcWTJhDxu3Dc ah6ymoXURH/d2JdTHdUvIgBFoRjHmZNWSMzPjt/50p5RdhfP/jgujlO5g6Me4KTa lLAMAGNWCipXHmCCGamO =LDL/ -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.