Vulnerability in isc-dhcp - Out-of-Bound Memory Access and Denial of Service
Summary
DLA-1313-1: isc-dhcp - security update. Affects isc-dhcp versions < 4.2.2.dfsg.1-5+deb70u9. Fixed in 4.2.2.dfsg.1-5+deb70u9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The isc-dhcp package is an open-source implementation of the Dynamic Host Configuration Protocol (DHCP) for managing network configuration parameters. It includes a client, relay, and server component. DHCP is widely used to automatically assign IP addresses and other network configuration settings to devices on a network. The isc-dhcp package is commonly used in Debian 7 Wheezy.
Vulnerability Detail
Two vulnerabilities have been discovered in the isc-dhcp package. The first vulnerability, identified as CVE-2018-5732, allows a malicious DHCP server to exploit an out-of-bound memory access vulnerability in the DHCP client. By sending specially crafted DHCP options responses, an attacker can potentially execute arbitrary code on the client machine. The second vulnerability, identified as CVE-2018-5733, affects the DHCP server and involves improper handling of reference counting when processing client requests. This flaw can be exploited by a malicious client to cause a denial of service (DHCP server crash) by sending a large amount of traffic.
How To Fix
Minimum fixed version
4.2.2.dfsg.1-5+deb70u9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade isc-dhcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the isc-dhcp package to the latest version is crucial to address the vulnerabilities and ensure the security of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for isc-dhcp →
FAQ
isc-dhcp is an open-source implementation of the Dynamic Host Configuration Protocol (DHCP) used for managing network configuration parameters.
CVE-2018-5732 allows a malicious DHCP server to execute arbitrary code on the client machine by exploiting an out-of-bound memory access vulnerability.
CVE-2018-5733 can be exploited by a malicious client to cause a denial of service (DHCP server crash) by sending a large amount of traffic.
To fix these vulnerabilities, upgrade the isc-dhcp package to version 4.2.2.dfsg.1-5+deb70u9 or later by following the instructions provided by Debian LTS security advisories.
No specific workaround has been mentioned for these vulnerabilities. It is recommended to upgrade the package to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for isc-dhcp.
