[Bug 720729] Re: DoS by sending message over IPv6 for a declined and abandoned address.

[Launchpad Bug Tracker]

This bug was fixed in the package isc-dhcp - 4.1.1-P1-15ubuntu3

---------------
isc-dhcp (4.1.1-P1-15ubuntu3) natty; urgency=low

  * SECURITY UPDATE: denial of service via processing of message from an address
    that was previously declined, causing assert failure. (LP: #720729)
    - debian/patches/CVE-2011-0413.dpatch: Reclaim the previously abandoned
      address in isc-dhcp/server/mdb6.c, by retagging the lease and adding
      a sane expiration value.  Based on changes between upstream releases
      4.1.2 and 4.1.2-P1
    - CVE-2011-0413
 -- Dave Walker (Daviey) <DaveWalker at ubuntu.com>   Thu, 17 Feb 2011 16:24:57 +0000

** Changed in: isc-dhcp (Ubuntu)
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is a direct subscriber.
https://bugs.launchpad.net/bugs/720729

Title:
  DoS by sending message over IPv6 for a declined and abandoned address.

Status in “isc-dhcp” package in Ubuntu:
  Fix Released
Status in “isc-dhcp” package in Debian:
  Fix Released

Bug description:
  "The DHCPv6 server in ISC DHCP 4.0.x and 4.1.x before 4.1.2-P1,
  4.0-ESV and 4.1-ESV before 4.1-ESV-R1, and 4.2.x before 4.2.1b1 allows
  remote attackers to cause a denial of service (assertion failure and
  daemon crash) by sending a message over IPv6 for a declined and
  abandoned address."