ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - dhcp: UDP payload length not properly checked (CVE-2015-8605)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dhcp: UDP payload length not properly checked (CVE-2015-8605)

  - dhcp: unclosed TCP connections to OMAPI or failover ports can cause DoS (CVE-2016-2774)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dhcp: unclosed TCP connections to OMAPI or failover ports can cause DoS (CVE-2016-2774)

  - dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

  - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a     denial of service (application crash) via an invalid length field in a UDP IPv4 packet. (CVE-2015-8605)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the dhcp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x     before 4.3.3-P1 allows remote attackers to cause a     denial of service (application crash) via an invalid     length field in a UDP IPv4 packet.(CVE-2015-8605)

  - A denial of service flaw was found in the way dhcpd     handled reference counting when processing client     requests. A malicious DHCP client could use this flaw     to trigger a reference count overflow on the server     side, potentially causing dhcpd to crash, by sending     large amounts of traffic.(CVE-2018-5733)

  - An out-of-bound memory access flaw was found in the way     dhclient processed a DHCP response packet. A malicious     DHCP server could potentially use this flaw to crash     dhclient processes running on DHCP client machines via     a crafted DHCP response packet.(CVE-2018-5732)

  - A resource-consumption flaw was discovered in the DHCP     server. dhcpd did not restrict the number of open     connections to OMAPI and failover ports. A remote     attacker able to establish TCP connections to one of     these ports could use this flaw to cause dhcpd to exit     unexpectedly, stop responding requests, or exhaust     system sockets (denial of service).(CVE-2016-2774)

  - It was found that the DHCP daemon did not properly     clean up closed OMAPI connections in certain cases. A     remote attacker able to connect to the OMAPI port could     use this flaw to exhaust file descriptors in the DHCP     daemon, leading to a denial of service in the OMAPI     functionality.(CVE-2017-3144)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the dhcp package has been released.

According to the version of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x     before 4.3.3-P1 allows remote attackers to cause a     denial of service (application crash) via an invalid     length field in a UDP IPv4 packet.(CVE-2015-8605)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A command injection flaw was found in the     NetworkManager integration script included in the DHCP     client packages in Red Hat Enterprise Linux. A     malicious DHCP server, or an attacker on the local     network able to spoof DHCP responses, could use this     flaw to execute arbitrary commands with root privileges     on systems using NetworkManager and configured to     obtain network configuration using the DHCP     protocol.(CVE-2018-1111)

  - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x     before 4.3.3-P1 allows remote attackers to cause a     denial of service (application crash) via an invalid     length field in a UDP IPv4 packet.(CVE-2015-8605)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ISC DHCP 4.x before 4.1-ESV-R12-P1 and 4.2.x and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.
(CVE-2015-8605)

Security fix for CVE-2015-8605

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dhcp fixes the following issues :

  - CVE-2015-8605: A remote attacker could have used badly     formed packets with an invalid IPv4 UDP length field to     cause a DHCP server, client, or relay program to     terminate abnormally (bsc#961305)

The following bugs were fixed :

  - bsc#936923: Improper lease duration checking

  - bsc#880984: Integer overflows in the date and time     handling code

  - bsc#956159: fixed service files to start dhcpd after     slapd

  - bsc#960506: Improve exit reason and logging when     /sbin/dhclient-script is unable to pre-init requested     interface

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for dhcp fixes the following issues :

  - CVE-2015-8605: A remote attacker could have used badly     formed packets with an invalid IPv4 UDP length field to     cause a DHCP server, client, or relay program to     terminate abnormally (boo#961305)

The following bugs were fixed :

  - boo#936923: Improper lease duration checking

  - boo#880984: Integer overflows in the date and time     handling code

  - boo#956159: fixed service files to start dhcpd after     slapd

  - boo#960506: Improve exit reason and logging when     /sbin/dhclient-script is unable to pre-init requested     interface

  - boo#947780: DHCP server could abort with 'Unable to set     up timer: out of range' on very long or infinite timer     intervals / lease lifetimes 

  - boo#912098: dhclient could pretend to run while silently     declining leases

  - boo#919959: server: Do not log success report before     send reported success

  - boo#928390: dhclient dit not expose next-server DHCPv4     option to script

  - boo#926159: DHCP preferrend and valid lifetime would be     logged incorrectly

  - boo#910686: Prevent a dependency conflict of dhcp-devel     with bind-devel package

This update for dhcp fixes the following issues :

  - CVE-2015-8605: A remote attacker could have used badly     formed packets with an invalid IPv4 UDP length field to     cause a DHCP server, client, or relay program to     terminate abnormally (bsc#961305)

The following bugs were fixed :

  - bsc#936923: Improper lease duration checking

  - bsc#880984: Integer overflows in the date and time     handling code

  - bsc#956159: fixed service files to start dhcpd after     slapd

  - bsc#960506: Improve exit reason and logging when     /sbin/dhclient-script is unable to pre-init requested     interface

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dhcp fixes the following issues :

  - CVE-2015-8605: A remote attacker could have used badly     formed packets with an invalid IPv4 UDP length field to     cause a DHCP server, client, or relay program to     terminate abnormally (bsc#961305)

The following bugs were fixed :

  - bsc#936923: Improper lease duration checking

  - bsc#880984: Integer overflows in the date and time     handling code

  - bsc#956159: fixed service files to start dhcpd after     slapd

  - bsc#960506: Improve exit reason and logging when     /sbin/dhclient-script is unable to pre-init requested     interface

  - bsc#947780: DHCP server could abort with 'Unable to set     up timer: out of range' on very long or infinite timer     intervals / lease lifetimes

  - bsc#912098: dhclient could pretend to run while silently     declining leases

  - bsc#919959: server: Do not log success report before     send reported success

  - bsc#928390: dhclient dit not expose next-server DHCPv4     option to script

  - bsc#926159: DHCP preferrend and valid lifetime would be     logged incorrectly

  - bsc#910686: Prevent a dependency conflict of dhcp-devel     with bind-devel package

The following tracked changes affect the build of the package only :

  - bsc#891961: Disabled /sbin/service legacy-action hooks

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dhcp fixes the following issues :

  - CVE-2015-8605: A remote attacker could have used badly     formed packets with an invalid IPv4 UDP length field to     cause a DHCP server, client, or relay program to     terminate abnormally (bsc#961305)

The following bugs were fixed :

  - bsc#936923: Improper lease duration checking

  - bsc#880984: Integer overflows in the date and time     handling code

  - bsc#947780: DHCP server could abort with 'Unable to set     up timer: out of range' on very long or infinite timer     intervals / lease lifetimes

  - bsc#926159: DHCP preferrend and valid lifetime would be     logged incorrectly

  - bsc#928390: dhclient dit not expose next-server DHCPv4     option to script

  - bsc#926159: DHCP preferrend and valid lifetime would be     logged incorrectly

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ISC reports :

A badly formed packet with an invalid IPv4 UDP length field can cause a DHCP server, client, or relay program to terminate abnormally.

ISC DHCP 4.x before 4.1-ESV-R12-P1 and 4.2.x and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.

With the previous upload of the isc-dhcp package to Debian Squeeze LTS two issues got introduced into LTS that are resolved by this upload.

(1)

CVE-2015-8605 had only been resolved for the LDAP variant of the DHCP server package built from the isc-dhcp source package. With upload of version 4.1.1-P1-15+squeeze10, now all DHCP server variants (LDAP and non-LDAP alike) include the fix for CVE-2015-8605. Thanks to Ben Hutchings for spotting this inaccuracy.

(2)

The amd64 binary build of the previously uploaded isc-dhcp version (4.1.1-P1-15+squeeze9) was flawed and searched for the dhcpd.conf configuration file at the wrong location [1,2,3]. This flaw in the amd64 build had been caused by a not-100%-pure-squeeze-lts build system on the maintainer's end. The amd64 build of version 4.1.1-P1-15+squeeze10 has been redone in a brand-new build environment and does not show the reported symptom(s) anymore.

I deeply apologize for the experienced inconvenience to all who encountered this issue.

[1] https://bugs.debian.org/811097 [2] https://bugs.debian.org/811397 [3] https://bugs.debian.org/811402

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2868-1 advisory.

    Sebastian Poehn discovered that the DHCP server, client, and relay incorrectly handled certain malformed     UDP packets. A remote attacker could use this issue to cause the DHCP server, client, or relay to stop     responding, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that a maliciously crafted packet can crash any of the isc-dhcp applications. This includes the DHCP client, relay, and server application. Only IPv4 setups are affected.

New dhcp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

ID	Name	Product	Family	Severity
199474	RHEL 7 : dhcp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199472	RHEL 6 : dhcp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199428	RHEL 5 : dhcp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
124946	EulerOS Virtualization 3.0.1.0 : dhcp (EulerOS-SA-2019-1443)	Nessus	Huawei Local Security Checks	high
121654	Photon OS 1.0: Dhcp PHSA-2016-0013	Nessus	PhotonOS Local Security Checks	medium
110738	EulerOS 2.0 SP3 : dhcp (EulerOS-SA-2018-1162)	Nessus	Huawei Local Security Checks	medium
110127	EulerOS 2.0 SP2 : dhcp (EulerOS-SA-2018-1123)	Nessus	Huawei Local Security Checks	high
110126	EulerOS 2.0 SP1 : dhcp (EulerOS-SA-2018-1122)	Nessus	Huawei Local Security Checks	high
90809	F5 Networks BIG-IP : ISC DHCP 4.x vulnerability (K57500018)	Nessus	F5 Networks Local Security Checks	medium
89594	Fedora 22 : dhcp-4.3.2-7.fc22 (2016-adb533a418)	Nessus	Fedora Local Security Checks	medium
89475	Fedora 23 : dhcp-4.3.3-8.P1.fc23 (2016-0c5bb21bf1)	Nessus	Fedora Local Security Checks	medium
89050	openSUSE Security Update : dhcp (openSUSE-2016-284)	Nessus	SuSE Local Security Checks	medium
89017	openSUSE Security Update : dhcp (openSUSE-2016-279)	Nessus	SuSE Local Security Checks	medium
88893	SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2016:0541-1)	Nessus	SuSE Local Security Checks	medium
88892	SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2016:0540-1)	Nessus	SuSE Local Security Checks	medium
88834	SUSE SLED11 / SLES11 Security Update : dhcp (SUSE-SU-2016:0481-1)	Nessus	SuSE Local Security Checks	medium
87981	FreeBSD : isc-dhcpd -- Denial of Service (05eeb7e9-b987-11e5-83ef-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
87971	Amazon Linux AMI : dhcp (ALAS-2016-637)	Nessus	Amazon Linux Local Security Checks	medium
87931	Debian DLA-385-2 : isc-dhcp regression update	Nessus	Debian Local Security Checks	medium
87916	Ubuntu 14.04 LTS : DHCP vulnerability (USN-2868-1)	Nessus	Ubuntu Local Security Checks	medium
87898	Debian DSA-3442-1 : isc-dhcp - security update	Nessus	Debian Local Security Checks	medium
87883	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : dhcp (SSA:2016-012-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2015-8605

medium

Tenable Plugins

medium

medium

high

high

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium