! A stack overflow vulnerability was fixed in dhclient that could allow

  remote attackers to execute arbitrary commands as root on the system,
  or simply terminate the client, by providing an over-long subnet-mask
  option.  [ISC-Bugs #19839]

diff --git a/RELNOTES b/RELNOTES
index c9b6b6c6b039111afe62b2430a92d2f9d2abb29d..aa1fa1bf8737227d9b96830de3a04ca6e1b8b5b3 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -144,6 +144,11 @@ work on other platforms. Please report any problems and suggested fixes to
 - A bug was fixed that caused the 'conflict-done' state to fail to be parsed
   in failover state records.
 
+! A stack overflow vulnerability was fixed in dhclient that could allow
+  remote attackers to execute arbitrary commands as root on the system,
+  or simply terminate the client, by providing an over-long subnet-mask
+  option.
+
                        Changes since 4.1.0b1
 
 - A missing "else" in dhcrelay.c could have caused an interface not to

diff --git a/client/dhclient.c b/client/dhclient.c
index 580c71268521ec0791c2d0fb84640ee09b715e63..99f0ec1a9f3bdb599b4b499a258958e20c281a31 100644 (file)
--- a/client/dhclient.c
+++ b/client/dhclient.c
@@ -3070,8 +3070,15 @@ void script_write_params (client, prefix, lease)
                if (data.len > 3) {
                        struct iaddr netmask, subnet, broadcast;
 
-                       memcpy (netmask.iabuf, data.data, data.len);
-                       netmask.len = data.len;
+                       /*
+                        * No matter the length of the subnet-mask option,
+                        * use only the first four octets.  Note that
+                        * subnet-mask options longer than 4 octets are not
+                        * in conformance with RFC 2132, but servers with this
+                        * flaw do exist.
+                        */
+                       memcpy(netmask.iabuf, data.data, 4);
+                       netmask.len = 4;
                        data_string_forget (&data, MDL);
 
                        subnet = subnet_number (lease -> address, netmask);