<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi All,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Does anyone has any update on this?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> P, Sreelakshmi <br>
<b>Sent:</b> Friday, December 7, 2018 4:19 PM<br>
<b>To:</b> 'dnsmasq-discuss@lists.thekelleys.org.uk' <dnsmasq-discuss@lists.thekelleys.org.uk><br>
<b>Subject:</b> Validation for malformed DHCP packets in dnsmasq<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are using dnsmasq 2.78. We see that there are some security vulnerability w.r.t malformed DHCP packets as explained below.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><b><u>Problem 1:<o:p></o:p></u></b></p>
<p class="MsoNormal" style="margin-left:.5in">A malformed dhcp discover packet can cause dhcp to be unresponsive from the switch for a small amount of time. If this was repeated over time an attacker could make the dhcp service unresponsive DOSing the box. <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">It starts out with the malformed discover immediately followed by a dhcp decline. then the client sends another dhcp discover packet. The switch does not respond to this discover.
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">After about two seconds the client tries again and dhcp works as normal. <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><b><u>Problem 2:<o:p></o:p></u></b></p>
<p class="MsoNormal" style="margin-left:.5in">DHCP request with anomaly causing DOS condition<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">A Malformed DHCP request causes dhcp server to not respond for a short period of time. The request is modified by reducing the size of the data in the mac address field in the dhcp request.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">After the request is sent to the switch the client sends another dhcp discover which is not responded to. After about 1.5 seconds the client tries again and the discover is responded to.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><b><u>Problem 3:<o:p></o:p></u></b></p>
<p class="MsoNormal" style="margin-left:.5in">DHCP discover packet with extra byte in hardware address causing DOS of DHCP on switch<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">If an extra byte is added to the hardware address field in a dhcp discover it will cause the DHCP service to become unresponsive for a short period of time. If repeated it could be used as a DOS attack.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><b><u>Problem 4:<o:p></o:p></u></b></p>
<p class="MsoNormal" style="margin-left:.5in">DHCPv6 solicit with anomaly in Identity association length field causing DOS<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">When the integer value 65534 is placed in the Identity association length field of a dhcpv6 solicit packet the switch enters a DOS state for a couple seconds<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><b><u>Problem 5:<o:p></o:p></u></b></p>
<p class="MsoNormal" style="margin-left:.5in">DHCPv6 solicit 2 Extra bytes trailing option status code causes DOS<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Sending dhcpv6 solicits with extra bytes trailing the option status code causes the switch dhcp server to become temporarily unresponsive.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In a summary, to overcome this problem, DHCP packet validation has to be done. Has any fix related to any of these problems have gone in after 2.78?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks in Advance!!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal">Sree<o:p></o:p></p>
</div>
</body>
</html>