CVE-2018-5732 A specially constructed response from a malicious server can cause a buffer overflow in dhclient
HighCVSS 7.5
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/isc-dhcp(Debian:12) | < 4.3.5-3.1 | 4.3.5-3.1 |
| debian/isc-dhcp(Debian:13) | < 4.3.5-3.1 | 4.3.5-3.1 |
| isc dhcp | >= 4.1.0, <= 4.1.2 | No fix listed |
| isc dhcp | >= 4.2.0, < 4.2.8 | 4.2.8 |
| isc dhcp | >= 4.3.0, < 4.3.6 | 4.3.6 |
| isc dhcp | = 4.1-esv | No fix listed |
| isc dhcp | = 4.1-esv-r1 | No fix listed |
| isc dhcp | = 4.1-esv-r10 | No fix listed |
| isc dhcp | = 4.1-esv-r10b1 | No fix listed |
| isc dhcp | = 4.1-esv-r10rc1 | No fix listed |
| isc dhcp | = 4.1-esv-r11 | No fix listed |
| isc dhcp | = 4.1-esv-r11b1 | No fix listed |
| isc dhcp | = 4.1-esv-r11rc1 | No fix listed |
| isc dhcp | = 4.1-esv-r11rc2 | No fix listed |
| isc dhcp | = 4.1-esv-r12 | No fix listed |
| isc dhcp | = 4.1-esv-r12-p1 | No fix listed |
| isc dhcp | = 4.1-esv-r12b1 | No fix listed |
| isc dhcp | = 4.1-esv-r13 | No fix listed |
| isc dhcp | = 4.1-esv-r13b1 | No fix listed |
| isc dhcp | = 4.1-esv-r14 | No fix listed |
| isc dhcp | = 4.1-esv-r14b1 | No fix listed |
| isc dhcp | = 4.1-esv-r15 | No fix listed |
| isc dhcp | = 4.1-esv-r2 | No fix listed |
| isc dhcp | = 4.1-esv-r3 | No fix listed |
| isc dhcp | = 4.1-esv-r3b1 | No fix listed |
Show 27 more
| Product | Affected versions | Fixed in |
|---|---|---|
| isc dhcp | = 4.1-esv-r4 | No fix listed |
| isc dhcp | = 4.1-esv-r5 | No fix listed |
| isc dhcp | = 4.1-esv-r5b1 | No fix listed |
| isc dhcp | = 4.1-esv-r5rc1 | No fix listed |
| isc dhcp | = 4.1-esv-r5rc2 | No fix listed |
| isc dhcp | = 4.1-esv-r6 | No fix listed |
| isc dhcp | = 4.1-esv-r7 | No fix listed |
| isc dhcp | = 4.1-esv-r8 | No fix listed |
| isc dhcp | = 4.1-esv-r8b1 | No fix listed |
| isc dhcp | = 4.1-esv-r8rc1 | No fix listed |
| isc dhcp | = 4.1-esv-r9 | No fix listed |
| isc dhcp | = 4.1-esv-r9b1 | No fix listed |
| isc dhcp | = 4.1-esv-r9rc1 | No fix listed |
| isc dhcp | = 4.1.2-p1 | No fix listed |
| isc dhcp | = 4.4.0 | No fix listed |
| alpine/dhcp(Alpine:v3.10) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.11) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.12) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.13) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.14) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.15) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.16) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.17) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.18) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.19) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.20) | >= 4.1.0, < 4.4.1-r0 | 4.4.1-r0 |
| ISC DHCP | = ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-5732 vendor-advisory
- kb.isc.org vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking