Ubuntu
dhcdbd package

Memory corruption fix

Bug #49104 reported by Florian Hackenberger
254
Affects Status Importance Assigned to Milestone
dhcdbd (Ubuntu)
Fix Released
Medium
Martin Pitt

Bug Description

Binary package hint: dhcdbd

Hi!

Please integrate the attached patch into dhcdbd and release a new version for Ubuntu. It fixes a memory corruption bug in dhcdbd which affects me and probably several other users. The bug prevents me from using NetworkManager as dhcdbd dies before NetworkManager is notified of a successful dhlease. AFAIK a memory corruption in a program running as root (can be triggered from remote as it results from a bad DHCP message) can be a security problem. You can also bump the dhcdbd version to 1.14+. But I'm not sure if that breaks NM for other Wifi cards. The bug is in RedHat Bugzilla as well: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189529

Regards, Florian

Revision history for this message
Florian Hackenberger (f-hackenberger) wrote : Fixes the memory corruption bug

Please apply and release a new dhcdbd

Revision history for this message
Martin Pitt (pitti) wrote :

Thanks for the patch! I'm going to release an update.

I also opened the bug for the public, since the impact is comparatively low and the bug is public in RedHat, too.

Changed in dhcdbd:
assignee: nobody → pitti
importance: Untriaged → Medium
status: Unconfirmed → In Progress
Revision history for this message
Martin Pitt (pitti) wrote :

Package for edgy prepared (can't upload yet), dapper-security uploaded and will soon be pushed out.

Changed in dhcdbd:
status: In Progress → Fix Committed
Revision history for this message
Martin Pitt (pitti) wrote :

dapper-security fixed in USN-299-1.

Revision history for this message
Martin Pitt (pitti) wrote :

Edgy fixed as well:

 dhcdbd (1.10-0ubuntu12) edgy; urgency=low
 .
   * SECURITY UPDATE: Remote DoS.
   * Add debian/patches/60-hexstr-verify-loop.patch:
     - Fix loops for verifying validity of a hex string (returned by DHCP
       server) to comprise the last character, too.
     - Thanks to Florian Hackenberger<email address hidden> for discovering
       this and for the patch.
     - For the record, this is fixed upstream in 1.14.
   * References:
     https://launchpad.net/bugs/49104
     https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189529

Changed in dhcdbd:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.