CVE-2018-5733 A malicious client can overflow a reference counter in ISC dhcpd
HighCVSS 7.5
EPSS 20.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/isc-dhcp(Debian:12) | < 4.3.5-3.1 | 4.3.5-3.1 |
| debian/isc-dhcp(Debian:13) | < 4.3.5-3.1 | 4.3.5-3.1 |
| isc dhcp | >= 4.2.0, <= 4.2.8 | No fix listed |
| isc dhcp | >= 4.3.0, <= 4.3.6 | No fix listed |
| isc dhcp | = 4.1-esv | No fix listed |
| isc dhcp | = 4.1-esv-r1 | No fix listed |
| isc dhcp | = 4.1-esv-r10 | No fix listed |
| isc dhcp | = 4.1-esv-r10_b1 | No fix listed |
| isc dhcp | = 4.1-esv-r10_rc1 | No fix listed |
| isc dhcp | = 4.1-esv-r11 | No fix listed |
| isc dhcp | = 4.1-esv-r11_b1 | No fix listed |
| isc dhcp | = 4.1-esv-r11_rc1 | No fix listed |
| isc dhcp | = 4.1-esv-r11_rc2 | No fix listed |
| isc dhcp | = 4.1-esv-r12 | No fix listed |
| isc dhcp | = 4.1-esv-r12_b1 | No fix listed |
| isc dhcp | = 4.1-esv-r12_p1 | No fix listed |
| isc dhcp | = 4.1-esv-r13 | No fix listed |
| isc dhcp | = 4.1-esv-r13_b1 | No fix listed |
| isc dhcp | = 4.1-esv-r14 | No fix listed |
| isc dhcp | = 4.1-esv-r14_b1 | No fix listed |
| isc dhcp | = 4.1-esv-r15 | No fix listed |
| isc dhcp | = 4.1-esv-r2 | No fix listed |
| isc dhcp | = 4.1-esv-r3 | No fix listed |
| isc dhcp | = 4.1-esv-r3_b1 | No fix listed |
| isc dhcp | = 4.1-esv-r4 | No fix listed |
Show 44 more
| Product | Affected versions | Fixed in |
|---|---|---|
| isc dhcp | = 4.1-esv-r5 | No fix listed |
| isc dhcp | = 4.1-esv-r5_b1 | No fix listed |
| isc dhcp | = 4.1-esv-r5_rc1 | No fix listed |
| isc dhcp | = 4.1-esv-r5_rc2 | No fix listed |
| isc dhcp | = 4.1-esv-r6 | No fix listed |
| isc dhcp | = 4.1-esv-r7 | No fix listed |
| isc dhcp | = 4.1-esv-r8 | No fix listed |
| isc dhcp | = 4.1-esv-r8_b1 | No fix listed |
| isc dhcp | = 4.1-esv-r8_rc1 | No fix listed |
| isc dhcp | = 4.1-esv-r9 | No fix listed |
| isc dhcp | = 4.1-esv-r9_b1 | No fix listed |
| isc dhcp | = 4.1-esv-r9_rc1 | No fix listed |
| isc dhcp | = 4.1-esv-rc1 | No fix listed |
| isc dhcp | = 4.1.0 | No fix listed |
| isc dhcp | = 4.4.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| alpine/dhcp(Alpine:v3.10) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.11) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.12) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.13) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.14) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.15) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.16) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.17) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.18) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.19) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| alpine/dhcp(Alpine:v3.20) | >= 4.2.0, < 4.4.1-r0 | 4.4.1-r0 |
| ISC DHCP | = ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-5733 vendor-advisory
- 103188 third-party-advisory vdb-entry
- 1040437 third-party-advisory vdb-entry
- RHSA-2018:0469 third-party-advisory vendor-advisory
- RHSA-2018:0483 third-party-advisory vendor-advisory
- kb.isc.org vendor-advisory
- [debian-lts-announce] 20180322 [SECURITY] [DLA 1313-1] isc-dhcp security update mailing-list third-party-advisory
- USN-3586-1 third-party-advisory vendor-advisory
- USN-3586-2 third-party-advisory vendor-advisory
- DSA-4133 third-party-advisory vendor-advisory
- security.netapp.com
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking