search menu icon-carat-right cmu-wordmark

CERT Coordination Center

ISC DHCP server DHCPv6 decline message processing vulnerability

Vulnerability Note VU#686084

Original Release Date: 2011-01-27 | Last Revised: 2011-01-28


ISC DHCPv6 versions 4.0.x - 4.2.x are susceptible to a denial-of-service vulnerability.


The ISC Advisory states:

"When the DHCPv6 server code processes a message for an address that was previously declined and internally tagged as abandoned it can trigger an assert failure resulting in the server crashing. This could be used to crash DHCPv6 servers remotely. This issue only affects DHCPv6 servers. DHCPv4 servers are unaffected."


A remote attacker may cause a denial of service.


Upgrade to 4.1.2-P1, 4.1-ESV-R1, or 4.2.1b1

Vendor Information

Affected   Unknown   Unaffected

Internet Systems Consortium

Notified:  January 24, 2011 Updated:  January 26, 2011



Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A



Thanks to Larissa Shapiro for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs: CVE-2011-0413
Severity Metric: 0.95
Date Public: 2011-01-26
Date First Published: 2011-01-27
Date Last Updated: 2011-01-28 12:38 UTC
Document Revision: 10

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.