When attempting to convert a DUID from a client id option

into a hardware address handle unexpected client ids properly.
Thanks to Markus Hietava of Codenomicon CROSS project for the
finding this issue and CERT-FI for vulnerability coordination.
[ISC-Bugs #29852]
CVE: CVE-2012-3570

diff --git a/RELNOTES b/RELNOTES
index c6615f2de5cadf2f9215490129b26862de564e40..cb82c53da5439cecd06b7a0bc7a2e629ca2ba60e 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -71,6 +71,13 @@ work on other platforms. Please report any problems and suggested fixes to
   [ISC-Bugs #29851]
   CVE: CVE-2012-3571
 
+! When attempting to convert a DUID from a client id option
+  into a hardware address handle unexpected client ids properly.
+  Thanks to Markus Hietava of Codenomicon CROSS project for the
+  finding this issue and CERT-FI for vulnerability coordination. 
+  [ISC-Bugs #29852]
+  CVE: CVE-2012-3570
+
                        Changes since 4.2.4rc2
 
 - None

diff --git a/includes/dhcpd.h b/includes/dhcpd.h
index 7a21d071b71b5a01b3a94e0450913e28a7a6db91..459dea5651a3d499e577695a5f011f6123c4dbb4 100644 (file)
--- a/includes/dhcpd.h
+++ b/includes/dhcpd.h
@@ -432,11 +432,17 @@ struct packet {
        isc_boolean_t unicast;
 };
 
-/* A network interface's MAC address. */
+/*
+ * A network interface's MAC address.
+ * 20 bytes for the hardware address
+ * and 1 byte for the type tag
+ */
+
+#define HARDWARE_ADDR_LEN 20
 
 struct hardware {
        u_int8_t hlen;
-       u_int8_t hbuf[21];
+       u_int8_t hbuf[HARDWARE_ADDR_LEN + 1];
 };
 
 #if defined(LDAP_CONFIGURATION)

diff --git a/server/dhcpv6.c b/server/dhcpv6.c
index afdf3bb50035934ad80c112d0137e48cd97e6cd7..eb86aeb0a5ce98c66ab1f101c9a59ae48c7c2406 100644 (file)
--- a/server/dhcpv6.c
+++ b/server/dhcpv6.c
@@ -6037,7 +6037,7 @@ find_hosts_by_duid_chaddr(struct host_decl **host,
                break;
        }
 
-       if (hlen == 0)
+       if ((hlen == 0) || (hlen > HARDWARE_ADDR_LEN)) 
                return 0;
 
        /*