Serious Vulnerabilities Patched in ISC DHCP Server

The Internet Systems Consortium (ISC) has released a security patch for its DHCP server software in order to address serious denial of service vulnerabilities.

The two defects, identified as CVE-2011-2748 and CVE-2011-2749, were found by David Zych from the University of Illinois and ISC's own development team.

The flaws can be exploited by sending maliciously-crafted DHCP or Bootp packets respectively to targeted servers causing them to halt.

The vulnerabilities have a 7.8 (high) score on the CVSS severity scale, but no public exploits are known to exist at this time.

This doesn't exclude the possibility of exploits being developed in the future by reverse engineering the patch, so administrators are advised to deploy the fixes as soon as possible.

People who can't upgrade to the newly released 3.1-ESV-R3, 4.1-ESV-R3 or 4.2.2 versions, can restrict DHCP and Bootp packets to their administrative domain in order to limit exposure.

ISC notes that this is the last release for the 3.1-ESV branch, the product reaching its end of life. Users are advised to upgrade.

Users can download the patched source packages from ISC's download page or receive them through their operating system's own distribution channels when they become available.

The Internet Systems Consortium is a non-profit corporation which maintains several open source software applications critical to the Internet infrastructure, like the hugely popular BIND DNS server. The organization also operates one of the Internet's 13 root name servers.

While not as serious as code execution vulnerabilities, denial of service flaws can cause serious disruptions to organizations and should also be addressed as soon as possible. The hacktivist group Anonymous is currently believed to be building a denial of service tool that will attack unpatched Apache servers with ease.