Vulnerability Development mailing list archives

Possible DHCP DOS attack


From: paul () KEEFER ORG (Paul Keefer)
Date: Wed, 2 Feb 2000 21:19:52 -0000


I hope this is the right forum for this.

I was contemplating DHCP and how many large organizations
rely on it today, and I had a vision so to speak.  What if
someone were to use up all of the available leases?  That
would essentially prevent anyone else from obtaining an
address.  That got me thinking to how easy it would be to
very quickly eat up all the addresses on a server.

It seems like it would be trivial to use a linux box to use
proxy arping to send out a large number of DHCP requests
until the server has no more to give out.

This of course assumes that the network is not using
switches that prevent multiple MACs per port, and that the
DHCP servers are not configured to give IPs out only to
specific MACs or something like that.

One thing that would make this particularly insidious is
that the entire attack would take only momemts, and would
last until the DHCP database was purged or the leases timed
out.

Has this already been addressed?  Am I missing something
fundamental about DHCP?


Current thread: