bootp enabled by default on dhcp reduce security?

Question

by default in Microsoft DHCP server configuration Bootp is enabled and choose both(accept DHCP request and Bootp )

i know that how this work and know about how configure two DHCP Server by Bootp enabled router. but i have a question...

can be this default configuration a security risk?

if can, how this make hack? (theoreticaly)

for example : in CISCO documents we have this:

Option to Ignore All BOOTP Requests

why we ignore that? a security reason?

Answer 1

DHCP supersedes BOOTP; you keep BOOTP around only to help old hardware and software which does not know DHCP. Anyway, both are about offering a service to whoever asks (namely, IP address allocation and publication of network configuration) so they are no more, and no less, a security issue than what their definition entails: by running a DHCP or BOOTP server, you make it easy for people to plug in and get network connectivity.

Neither is more secure than the other, but if you offer both then you must mind both when it comes to controlling access to that service (e.g. MAC filtering). See this page for a comparison.

The usual security stance applies: if a service is not needed for operations, then don't enable it. To know if a service is needed for operations, disable it and see what breaks. In that case, deactivate BOOTP, and if you can live without it (which is probable), just leave it deactivated.

Answer 2

Enabling a diskless bootstrapping feature option (BOOTP) for DHCP when you don’t need it would expand your attack surface and diminish your overall security posture.

Any system that can accomplish a network boot (typically a Preboot Execution Environment PXE boot feature in the BIOS) would be provided another method to boot and gain access to the system. The network boot attack would almost certainly be an insider attack as other boot image configuration would be needed. The attacker is aided when owning the system by network boot by the fact that no persistent logging will occur on the target system as the OS is running in RAM with all details lost at power off or reboot.

Also BOOTP services typically use Trivial File Transfer Protocol (TFTP) to enable the movement of the boot image across the network,. TFTP is ‘trivial’ due to the lack of authentication in its protocol. Unauthenticated FTP on your system when it is not needed is yet more diminished security.