From 5a7344b05081d84343a1627e47478f3990b17700 Mon Sep 17 00:00:00 2001 From: Minjae Kim Date: Thu, 8 Jul 2021 00:08:25 +0000 Subject: [PATCH] ISC has disclosed a vulnerability in ISC DHCP (CVE-2021-25217) On May 26, 2021, we (Internet Systems Consortium) disclosed a vulnerability affecting our ISC DHCP software: CVE-2021-25217: A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient https://kb.isc.org/docs/cve-2021-25217 New versions of ISC DHCP are available from https://www.isc.org/downloads Operators and package maintainers who prefer to apply patches selectively can find individual vulnerability-specific patches in the "patches" subdirectory of the release directories for our two stable release branches (4.4 and 4.1-ESV) https://downloads.isc.org/isc/dhcp/4.4.2-P1/patches https://downloads.isc.org/isc/dhcp/4.1-ESV-R16-P1/patches With the public announcement of this vulnerability, the embargo period is ended and any updated software packages that have been prepared may be released. Upstream-Status: Accepted [https://www.openwall.com/lists/oss-security/2021/05/26/6] CVE: CVE-2021-25217 Signed-off-by: Minjae Kim --- common/parse.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/common/parse.c b/common/parse.c index 386a632..fc7b39c 100644 --- a/common/parse.c +++ b/common/parse.c @@ -3,7 +3,7 @@ Common parser code for dhcpd and dhclient. */ /* - * Copyright (c) 2004-2019 by Internet Systems Consortium, Inc. ("ISC") + * Copyright (c) 2004-2021 by Internet Systems Consortium, Inc. ("ISC") * Copyright (c) 1995-2003 by Internet Software Consortium * * This Source Code Form is subject to the terms of the Mozilla Public @@ -5556,13 +5556,14 @@ int parse_X (cfile, buf, max) skip_to_semi (cfile); return 0; } - convert_num (cfile, &buf [len], val, 16, 8); - if (len++ > max) { + if (len >= max) { parse_warn (cfile, "hexadecimal constant too long."); skip_to_semi (cfile); return 0; } + convert_num (cfile, &buf [len], val, 16, 8); + len++; token = peek_token (&val, (unsigned *)0, cfile); if (token == COLON) token = next_token (&val, -- 2.17.1