isc-dhcp: CVE-2017-3144: dhcp: omapi code doesn't free socket descriptors when empty message is received allowing denial-of-service

Related Vulnerabilities: CVE-2017-3144   CVE-2018-5733   CVE-2018-5732  

Debian Bug report logs - #887413
isc-dhcp: CVE-2017-3144: dhcp: omapi code doesn't free socket descriptors when empty message is received allowing denial-of-service

version graph

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Tue, 16 Jan 2018 06:54:10 UTC

Severity: important

Tags: patch, security, upstream

Found in versions isc-dhcp/4.2.2.dfsg.1-5+deb70u8, isc-dhcp/4.3.1-6

Fixed in versions isc-dhcp/4.3.5-3.1, isc-dhcp/4.3.5-3+deb9u1, isc-dhcp/4.3.1-6+deb8u3

Done: Salvatore Bonaccorso <carnil@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>:
Bug#887413; Package src:isc-dhcp. (Tue, 16 Jan 2018 06:54:13 GMT) (full text, mbox, link).


Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>. (Tue, 16 Jan 2018 06:54:13 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: isc-dhcp: CVE-2017-3144: dhcp: omapi code doesn't free socket descriptors when empty message is received allowing denial-of-service
Date: Tue, 16 Jan 2018 07:53:31 +0100
Source: isc-dhcp
Version: 4.3.1-6
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for isc-dhcp.

CVE-2017-3144[0]:
|dhcp: omapi code doesn't free socket descriptors when empty message is
|received allowing denial-of-service

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-3144
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3144
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1522918
[2] https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commit;h=1a6b62fe17a42b00fa234d06b6dfde3d03451894

Regards,
Salvatore



Information forwarded to debian-bugs-dist@lists.debian.org, Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>:
Bug#887413; Package src:isc-dhcp. (Tue, 16 Jan 2018 11:36:06 GMT) (full text, mbox, link).


Acknowledgement sent to Guido Günther <agx@sigxcpu.org>:
Extra info received and forwarded to list. Copy sent to Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>. (Tue, 16 Jan 2018 11:36:06 GMT) (full text, mbox, link).


Message #10 received at 887413@bugs.debian.org (full text, mbox, reply):

From: Guido Günther <agx@sigxcpu.org>
To: 887413@bugs.debian.org
Cc: debian-lts@lists.debian.org
Subject: Fixing CVE-2017-3144 in isc-dhcp in Wheezy?
Date: Tue, 16 Jan 2018 12:32:46 +0100
control: found -1 isc-dhcp/4.2.2.dfsg.1-5+deb70u8

Dear maintainer(s),

The Debian LTS team would like to fix this security issues
in the Wheezy version of isc-dhcp.

Would you like to take care of this yourself?

If yes, please follow the workflow we have defined here:
https://wiki.debian.org/LTS/Development

If that workflow is a burden to you, feel free to just prepare an
updated source package and send it to debian-lts@lists.debian.org
(via a debdiff, or with an URL pointing to the source package,
or even with a pointer to your packaging repository), and the members
of the LTS team will take care of the rest. Indicate clearly whether you
have tested the updated package or not.

If you don't want to take care of this update, it's not a problem, we
will do our best with your package. Just let us know whether you would
like to review and/or test the updated package before it gets released.

You can also opt-out from receiving future similar emails in your
answer and then the LTS Team will take care of isc-dhcp updates
for the LTS releases.

Thank you very much.

Guido Günther,
  on behalf of the Debian LTS team.

PS: A member of the LTS team might start working on this update at
any point in time. You can verify whether someone is registered
on this update in this file:
https://salsa.debian.org/security-tracker-team/security-tracker/raw/master/data/dla-needed.txt



Marked as found in versions isc-dhcp/4.2.2.dfsg.1-5+deb70u8. Request was from Guido Günther <agx@sigxcpu.org> to 887413-submit@bugs.debian.org. (Tue, 16 Jan 2018 11:36:06 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>:
Bug#887413; Package src:isc-dhcp. (Sun, 04 Mar 2018 20:45:03 GMT) (full text, mbox, link).


Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>. (Sun, 04 Mar 2018 20:45:03 GMT) (full text, mbox, link).


Message #17 received at 887413@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 887413@bugs.debian.org, 891785@bugs.debian.org, 891786@bugs.debian.org
Subject: isc-dhcp: diff for NMU version 4.3.5-3.1
Date: Sun, 4 Mar 2018 21:44:09 +0100
[Message part 1 (text/plain, inline)]
Control: tags 887413 + patch
Control: tags 887413 + pending
Control: tags 891785 + patch
Control: tags 891785 + pending
Control: tags 891786 + patch
Control: tags 891786 + pending

Dear maintainer,

I've prepared an NMU for isc-dhcp (versioned as 4.3.5-3.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.

You will note I included as well in the diff the part with respect of
the unittests. I was unable to get a setup working so that i can run
those to verify the fixes specifically with the unittest added. But I
opted in to keep those for benefit of any fetching the source and able
to run the unittests.

Regards,
Salvatore
[isc-dhcp-4.3.5-3.1-nmu.diff (text/x-diff, attachment)]

Added tag(s) patch. Request was from Salvatore Bonaccorso <carnil@debian.org> to 887413-submit@bugs.debian.org. (Sun, 04 Mar 2018 20:45:03 GMT) (full text, mbox, link).


Added tag(s) pending. Request was from Salvatore Bonaccorso <carnil@debian.org> to 887413-submit@bugs.debian.org. (Sun, 04 Mar 2018 20:45:04 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>:
Bug#887413; Package src:isc-dhcp. (Sun, 04 Mar 2018 21:51:05 GMT) (full text, mbox, link).


Acknowledgement sent to Michael Gilbert <mgilbert@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>. (Sun, 04 Mar 2018 21:51:05 GMT) (full text, mbox, link).


Message #26 received at 887413@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <mgilbert@debian.org>
To: Salvatore Bonaccorso <carnil@debian.org>, 891786@bugs.debian.org
Cc: 887413@bugs.debian.org, 891785@bugs.debian.org
Subject: Re: [pkg-dhcp-devel] Bug#891786: isc-dhcp: diff for NMU version 4.3.5-3.1
Date: Sun, 4 Mar 2018 16:47:10 -0500
On Sun, Mar 4, 2018 at 3:44 PM, Salvatore Bonaccorso wrote:
> I've prepared an NMU for isc-dhcp (versioned as 4.3.5-3.1) and
> uploaded it to DELAYED/2. Please feel free to tell me if I
> should delay it longer.

Hi Salvatore,

Some meaningless whitespace is touched, but otherwise your patches
look correct.  Please feel free to remove the delay.

Best wishes,
Mike



Reply sent to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility. (Mon, 05 Mar 2018 05:57:03 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Mon, 05 Mar 2018 05:57:03 GMT) (full text, mbox, link).


Message #31 received at 887413-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 887413-close@bugs.debian.org
Subject: Bug#887413: fixed in isc-dhcp 4.3.5-3.1
Date: Mon, 05 Mar 2018 05:52:39 +0000
Source: isc-dhcp
Source-Version: 4.3.5-3.1

We believe that the bug you reported is fixed in the latest version of
isc-dhcp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 887413@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated isc-dhcp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 04 Mar 2018 21:35:31 +0100
Source: isc-dhcp
Binary: isc-dhcp-server isc-dhcp-server-ldap isc-dhcp-common isc-dhcp-dev isc-dhcp-client isc-dhcp-client-ddns isc-dhcp-client-udeb isc-dhcp-relay
Architecture: source
Version: 4.3.5-3.1
Distribution: unstable
Urgency: medium
Maintainer: Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 887413 891785 891786
Description: 
 isc-dhcp-client - DHCP client for automatically obtaining an IP address
 isc-dhcp-client-ddns - Dynamic DNS (DDNS) enabled DHCP client
 isc-dhcp-client-udeb - ISC DHCP Client for debian-installer (udeb)
 isc-dhcp-common - common manpages relevant to all of the isc-dhcp packages
 isc-dhcp-dev - API for accessing and modifying the DHCP server and client state
 isc-dhcp-relay - ISC DHCP relay daemon
 isc-dhcp-server - ISC DHCP server for automatic IP address assignment
 isc-dhcp-server-ldap - DHCP server that uses LDAP as its backend
Changes:
 isc-dhcp (4.3.5-3.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Plugs a socket descriptor leak in OMAPI (CVE-2017-3144) (Closes: #887413)
   * Corrected refcnt loss in option parsing (CVE-2018-5733) (Closes: #891785)
   * Correct buffer overrun in pretty_print_option (CVE-2018-5732)
     (Closes: #891786)
Checksums-Sha1: 
 ecb8124333b531ec319084cc951d491bffa8ea71 2738 isc-dhcp_4.3.5-3.1.dsc
 d72f63506b3d72cfb6ff63cb72005ad1dc0cb294 88780 isc-dhcp_4.3.5-3.1.debian.tar.xz
Checksums-Sha256: 
 4a22b4f74323bbaab93ae9575b4cc1b23caa9a62a192cd9842369be76fe8459d 2738 isc-dhcp_4.3.5-3.1.dsc
 253edf711a9aa5bdc00a9ab8920acf337cedd64f3e7566c46a8e307835dfc6d8 88780 isc-dhcp_4.3.5-3.1.debian.tar.xz
Files: 
 749107e35764de87138113db0bc3a4d9 2738 net important isc-dhcp_4.3.5-3.1.dsc
 94f0336ee332d7c91711772eef390bf8 88780 net important isc-dhcp_4.3.5-3.1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqcWfVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EJxYP/2FHTJLHuEXWC6O9siDbDz5XKCEH+CsI
4QWfqgHqaHhscEAHoKbFEnLGoSrRdowuBtt7Qr8FGBwApLsVSjuf1xbD9nMJTHHc
JNHLt9sbM/7RQgQX08jI+rQFhG0mtutV/t5mjfgI+YbJXIj4w5zU65IbQudBhyoV
EYvznglZti8KHfJAey3gFTFIOfSkIC5UJI8lV0Mk2um6IizTrEOIPxnBUvSxZNN9
7a7gUYZ+GoDVB/DHWOdJ4AKZHsIC1IN4E99dEu0Ak5S4px+Li7nfmSRtDkDa137q
hOtJ76QN7NPxrsky6r7YUXLNeUO2W7QuMv8B/i5fZDlCpzFpcfG2evrGYevIlupk
p4T1BTOGBFE0CBQXVt1m48VrRps4wJ1eHRYNMoyPC3jahwmyw9YIf9nMFNgm/LiP
d3gGOpG52117gF68sGSiqPDWrZE78Vb5RK0gUk/1w3UZ2ZyZJLUY8TuiYNKfSSqs
jAoC5RfighSCZUx8Cr5ezc+g0Pa2Tp6v3aE5l/uhDRrh4OiCeoK3wDiQ+S6hZbL/
QGU0jtXPF7Pu/d8rBJgaHFms5Pmg8js3njM4U/xKGc0MGzFjCMtWgSlKAenDEq+9
jGGwSWpF44/dqgJIq/yo2aLeL6otJLS7VnSXgf7aWFtHxSsVTTZ/xrDvZMPrYMWP
tvj2x/Ub2r8q
=3/Ku
-----END PGP SIGNATURE-----




Information forwarded to debian-bugs-dist@lists.debian.org, Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>:
Bug#887413; Package src:isc-dhcp. (Mon, 05 Mar 2018 06:36:05 GMT) (full text, mbox, link).


Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>. (Mon, 05 Mar 2018 06:36:05 GMT) (full text, mbox, link).


Message #36 received at 887413@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Michael Gilbert <mgilbert@debian.org>
Cc: 891786@bugs.debian.org, 887413@bugs.debian.org, 891785@bugs.debian.org
Subject: Re: [pkg-dhcp-devel] Bug#891786: isc-dhcp: diff for NMU version 4.3.5-3.1
Date: Mon, 5 Mar 2018 07:32:52 +0100
Hi Mike,

On Sun, Mar 04, 2018 at 04:47:10PM -0500, Michael Gilbert wrote:
> On Sun, Mar 4, 2018 at 3:44 PM, Salvatore Bonaccorso wrote:
> > I've prepared an NMU for isc-dhcp (versioned as 4.3.5-3.1) and
> > uploaded it to DELAYED/2. Please feel free to tell me if I
> > should delay it longer.
> 
> Hi Salvatore,
> 
> Some meaningless whitespace is touched, but otherwise your patches
> look correct.  Please feel free to remove the delay.

Thank you, I rescheduled it!

Regards,
Salvatore



Reply sent to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility. (Sat, 10 Mar 2018 23:21:17 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Sat, 10 Mar 2018 23:21:17 GMT) (full text, mbox, link).


Message #41 received at 887413-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 887413-close@bugs.debian.org
Subject: Bug#887413: fixed in isc-dhcp 4.3.5-3+deb9u1
Date: Sat, 10 Mar 2018 23:17:09 +0000
Source: isc-dhcp
Source-Version: 4.3.5-3+deb9u1

We believe that the bug you reported is fixed in the latest version of
isc-dhcp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 887413@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated isc-dhcp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 03 Mar 2018 17:27:05 +0100
Source: isc-dhcp
Binary: isc-dhcp-server isc-dhcp-server-ldap isc-dhcp-common isc-dhcp-dev isc-dhcp-client isc-dhcp-client-ddns isc-dhcp-client-udeb isc-dhcp-relay
Architecture: source
Version: 4.3.5-3+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 887413 891785 891786
Description: 
 isc-dhcp-client - DHCP client for automatically obtaining an IP address
 isc-dhcp-client-ddns - Dynamic DNS (DDNS) enabled DHCP client
 isc-dhcp-client-udeb - ISC DHCP Client for debian-installer (udeb)
 isc-dhcp-common - common manpages relevant to all of the isc-dhcp packages
 isc-dhcp-dev - API for accessing and modifying the DHCP server and client state
 isc-dhcp-relay - ISC DHCP relay daemon
 isc-dhcp-server - ISC DHCP server for automatic IP address assignment
 isc-dhcp-server-ldap - DHCP server that uses LDAP as its backend
Changes:
 isc-dhcp (4.3.5-3+deb9u1) stretch-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Plugs a socket descriptor leak in OMAPI (CVE-2017-3144) (Closes: #887413)
   * Corrected refcnt loss in option parsing (CVE-2018-5733) (Closes: #891785)
   * Correct buffer overrun in pretty_print_option (CVE-2018-5732)
     (Closes: #891786)
Checksums-Sha1: 
 338da0ef3cb08b96d4da99c0608671914b6fce7a 2758 isc-dhcp_4.3.5-3+deb9u1.dsc
 283ad78a33d0fa28cb6c338353c66e3d96bf3499 1141640 isc-dhcp_4.3.5.orig.tar.gz
 e7efef64943a2177ec8f6ce38b282b0781979214 88808 isc-dhcp_4.3.5-3+deb9u1.debian.tar.xz
Checksums-Sha256: 
 45426dfbcf1d0efe22032f8b94e11992071997543c630bde66f403de22f4aa83 2758 isc-dhcp_4.3.5-3+deb9u1.dsc
 36fbfbbe4b7d44fa588e34a3339656be9f5ae33748452d243fe5fa5321a115e5 1141640 isc-dhcp_4.3.5.orig.tar.gz
 52ebb5fff096ad9a2fa2bf0c148a1b511b85373de70146f0234fed0224613227 88808 isc-dhcp_4.3.5-3+deb9u1.debian.tar.xz
Files: 
 7f26f6068303167de657f3c430bf6186 2758 net important isc-dhcp_4.3.5-3+deb9u1.dsc
 2cc305b76cf4a75ae57822f90a122437 1141640 net important isc-dhcp_4.3.5.orig.tar.gz
 0bc8871c6179c5b91ff3918320cad3a5 88808 net important isc-dhcp_4.3.5-3+deb9u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqbAjhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89ErkUP/R6ppMADrvkjX0x8/d2exSLBY4iUPo0d
LoARbSs+DCyXjf4kWnR9lV73hv2639uQZ6ziTdE67PsnEMTRz90GUuFz6kCGneOa
pKCfKy2/urEHL7VwHG0ncBz4JDbxomD2lQdTmXmlKB1OCqLBGATDMpcntkUX98VW
1PTXXj7ZFcJUyHUtzF9Pao5esq2oQ+2m15mvtD5FMMi5vAwRxQbNQmBvwP/pCs8Q
Kwh971Z/fesbkzBS/qEN/MdUym7cdGM9vU9MKf05q+O+7kdfEBRsWofIE+lJ4mfT
MoKQ+Gi/tqMVMIMI5WZWwG0OERUQ40F70Y9qUoXJuAcvMU+ynaYyhGvkKprfOIKR
6QIjrHkuzKT57CYdBsAcitD0ISYOxeUcnbAzGQCHtTWbMYLNIBlkHsl6J7hIs2EW
YZ1tqUy+8jKWw1HHNKrNwo09OWSURQ2g6k7lsh4dapm/dmNMtnYXeQbjwhK39/nv
W9dT08Ph7mlj40mt53TwAlkux63ncXbEcXbdhWVytVJnv+ib9RciDgxa4VL93qfh
WAe2uwIi3S01IUd8PCjt2HzCa+0CN41k6kYA+V6FsTMat+bcyqJ4hEmlEZffbeYk
WSeYXLMy58qfD8uFmmrirYEGOZwixm9xyWCL3L6eLMokzl8P/hR6x/EHA1WQdXFp
b2fls+o6/sca
=sve+
-----END PGP SIGNATURE-----




Reply sent to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility. (Sat, 10 Mar 2018 23:21:19 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Sat, 10 Mar 2018 23:21:19 GMT) (full text, mbox, link).


Message #46 received at 887413-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 887413-close@bugs.debian.org
Subject: Bug#887413: fixed in isc-dhcp 4.3.1-6+deb8u3
Date: Sat, 10 Mar 2018 23:18:09 +0000
Source: isc-dhcp
Source-Version: 4.3.1-6+deb8u3

We believe that the bug you reported is fixed in the latest version of
isc-dhcp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 887413@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated isc-dhcp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 04 Mar 2018 11:20:38 +0100
Source: isc-dhcp
Binary: isc-dhcp-server isc-dhcp-server-dbg isc-dhcp-dbg isc-dhcp-server-ldap isc-dhcp-common isc-dhcp-dev isc-dhcp-client isc-dhcp-client-dbg isc-dhcp-client-udeb isc-dhcp-relay isc-dhcp-relay-dbg
Architecture: source
Version: 4.3.1-6+deb8u3
Distribution: jessie-security
Urgency: high
Maintainer: Debian ISC DHCP maintainers <pkg-dhcp-devel@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 887413 891785 891786
Description: 
 isc-dhcp-client - DHCP client for automatically obtaining an IP address
 isc-dhcp-client-dbg - ISC DHCP server for automatic IP address assignment (client debug
 isc-dhcp-client-udeb - ISC DHCP Client for debian-installer (udeb)
 isc-dhcp-common - common files used by all of the isc-dhcp packages
 isc-dhcp-dbg - ISC DHCP server for automatic IP address assignment (debuging sym
 isc-dhcp-dev - API for accessing and modifying the DHCP server and client state
 isc-dhcp-relay - ISC DHCP relay daemon
 isc-dhcp-relay-dbg - ISC DHCP server for automatic IP address assignment (relay debug)
 isc-dhcp-server - ISC DHCP server for automatic IP address assignment
 isc-dhcp-server-dbg - ISC DHCP server for automatic IP address assignment (server debug
 isc-dhcp-server-ldap - DHCP server that uses LDAP as its backend
Changes:
 isc-dhcp (4.3.1-6+deb8u3) jessie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Plugs a socket descriptor leak in OMAPI (CVE-2017-3144) (Closes: #887413)
   * Corrected refcnt loss in option parsing (CVE-2018-5733) (Closes: #891785)
   * Correct buffer overrun in pretty_print_option (CVE-2018-5732)
     (Closes: #891786)
Checksums-Sha1: 
 33ee8547bc7752fb856ab15e89be074959437d24 2932 isc-dhcp_4.3.1-6+deb8u3.dsc
 09e24193a2c4533d983ef04c165f2166ed5cf537 83408 isc-dhcp_4.3.1-6+deb8u3.debian.tar.xz
Checksums-Sha256: 
 5d7225a4ac38cdf7dd4a298e95a59207a28ce1975feb9869ff5dd0049000784c 2932 isc-dhcp_4.3.1-6+deb8u3.dsc
 932e7e4d99036aa0b446bac1b9c6ac7d289cbaa4300ba96ef2d3e9bd0d6020e4 83408 isc-dhcp_4.3.1-6+deb8u3.debian.tar.xz
Files: 
 0d8d5e28391d45dd13552a77707f53bb 2932 net important isc-dhcp_4.3.1-6+deb8u3.dsc
 28829aa858547ad19cbadf8d74ab127e 83408 net important isc-dhcp_4.3.1-6+deb8u3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqbzytfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EQBUQAIK/cOhveoExk4I5f7M7/K7+j51I6TXH
0q5Vuc0ERKiE2KwpL8/OGN3nmlKB/b6gP1T231WvrwzZqdjLgndJ2s56QBHknE0k
gX05IkpeXg5J5XW3G96nJrvW5HKSlOhdSMe9xM5yjKhUctspHH2yDJRFobT+Rns1
tdQMqrvno6CgyHkA7JJsUHQrK35CKjW/1bR2ipTPcstZ1WrjnX6vmzykN5mhbYMw
Dx2i2jpLrGEZ1blC3VpOiSGf8sCZhcibOKy/wPGUIf5LR775wIAWqN0FPQRyo0k7
5f49gmnMrYcuI0nxwIgeLrZU1gWRroHj1Pvw95X3N964yOB4DhlIoE25gNG8ZHFU
gSolgonNQdf4KbeTMqCwfU9RJ5cbVNIBJBllBKyajgdimDRmJ3iha1DpLeZEL1sG
DkmFIIg5YrJf/CCu/yNHe3CawcsQPsWj6zB1ozuPc+eoNXZ+alk2Vi6cfi3IrEHf
bCOfuJNff74MS+sGHPcz3cyb7J83x9Wx8Javsno04bneSt8tRDtxoIjA1NHy0Gh5
Wi6ARAciUTMjQoYtqiC/HJJ5kfPSeevOfDUbwFh0We10YfZu4x6Bh4tDx0NVrcU5
eBIiqvSqudYilyKYmBS0/3v+NIWA8pYg6O3P1jXFm5zm2UqxF0x9O09vsRkIoTZj
JqINx0nY9C0K
=72jv
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 29 May 2018 07:26:43 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 14:00:49 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.