Your message dated Fri, 9 Oct 2009 00:47:08 +1000
with message-id <20091008144708.gq24...@daedalus.andrew.net.au>
and subject line Fixed in 3.1.2p1-2
has caused the Debian Bug report #539492,
regarding CVE-2009-1892: DoS
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
539492: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539492
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: dhcp3-server
Severity: grave
Tags: security patch
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for dhcp3.
CVE-2009-1892[0]:
| dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-identifier and
| hardware ethernet configuration settings are both used, allows remote
| attackers to cause a denial of service (daemon crash) via unspecified
| requests.
The patch that was used for the DSA is attached.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
Cheers
Steffen
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1892
http://security-tracker.debian.net/tracker/CVE-2009-1892
#! /bin/sh /usr/share/dpatch/dpatch-run
## server-clientid-crash.dpatch by Christoh Biedl <debian.packages.h...@manchmal.in-ulm.de>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Server assert involving client IDs (CVE-2009-1892)
@DPATCH@
diff -urNad git~/server/dhcp.c git/server/dhcp.c
--- git~/server/dhcp.c 2009-07-12 22:03:17.000000000 +0200
+++ git/server/dhcp.c 2009-07-12 22:04:42.000000000 +0200
@@ -1747,6 +1747,8 @@
host_reference (&host, h, MDL);
}
if (!host) {
+ if (hp)
+ host_dereference (&hp, MDL);
find_hosts_by_haddr (&hp,
packet -> raw -> htype,
packet -> raw -> chaddr,
--- End Message ---
--- Begin Message ---
Version: 3.1.2p1-2
This was fixed in 3.1.2p1-2
signature.asc
Description: Digital signature
--- End Message ---
