1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
From 5a7344b05081d84343a1627e47478f3990b17700 Mon Sep 17 00:00:00 2001
From: Minjae Kim <flowergom@gmail.com>
Date: Thu, 8 Jul 2021 00:08:25 +0000
Subject: [PATCH] ISC has disclosed a vulnerability in ISC DHCP
(CVE-2021-25217)
On May 26, 2021, we (Internet Systems Consortium) disclosed a
vulnerability affecting our ISC DHCP software:
CVE-2021-25217: A buffer overrun in lease file parsing code can be
used to exploit a common vulnerability shared by dhcpd and dhclient
https://kb.isc.org/docs/cve-2021-25217
New versions of ISC DHCP are available from https://www.isc.org/downloads
Operators and package maintainers who prefer to apply patches selectively can
find individual vulnerability-specific patches in the "patches" subdirectory
of the release directories for our two stable release branches (4.4 and 4.1-ESV)
https://downloads.isc.org/isc/dhcp/4.4.2-P1/patches
https://downloads.isc.org/isc/dhcp/4.1-ESV-R16-P1/patches
With the public announcement of this vulnerability, the embargo
period is ended and any updated software packages that have been
prepared may be released.
Upstream-Status: Accepted [https://www.openwall.com/lists/oss-security/2021/05/26/6]
CVE: CVE-2021-25217
Signed-off-by: Minjae Kim <flowergom@gmail.com>
---
common/parse.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/common/parse.c b/common/parse.c
index 386a632..fc7b39c 100644
--- a/common/parse.c
+++ b/common/parse.c
@@ -3,7 +3,7 @@
Common parser code for dhcpd and dhclient. */
/*
- * Copyright (c) 2004-2019 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2004-2021 by Internet Systems Consortium, Inc. ("ISC")
* Copyright (c) 1995-2003 by Internet Software Consortium
*
* This Source Code Form is subject to the terms of the Mozilla Public
@@ -5556,13 +5556,14 @@ int parse_X (cfile, buf, max)
skip_to_semi (cfile);
return 0;
}
- convert_num (cfile, &buf [len], val, 16, 8);
- if (len++ > max) {
+ if (len >= max) {
parse_warn (cfile,
"hexadecimal constant too long.");
skip_to_semi (cfile);
return 0;
}
+ convert_num (cfile, &buf [len], val, 16, 8);
+ len++;
token = peek_token (&val, (unsigned *)0, cfile);
if (token == COLON)
token = next_token (&val,
--
2.17.1
|
