ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dhcp: UDP payload length not properly checked (CVE-2015-8605)

  - dhcp: unclosed TCP connections to OMAPI or failover ports can cause DoS (CVE-2016-2774)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dhcp: unclosed TCP connections to OMAPI or failover ports can cause DoS (CVE-2016-2774)

  - dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

  - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a     denial of service (application crash) via an invalid length field in a UDP IPv4 packet. (CVE-2015-8605)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

An issue has been found in isc-dhcp, a server for automatic IP address assignment.

The number of simultaneous open TCP connections to OMAPI port of the server has to be limited to 200 in order to avoid a denial of service.

For Debian 8 'Jessie', this problem has been fixed in version 4.3.1-6+deb8u4.

We recommend that you upgrade your isc-dhcp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the dhcp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x     before 4.3.3-P1 allows remote attackers to cause a     denial of service (application crash) via an invalid     length field in a UDP IPv4 packet.(CVE-2015-8605)

  - A denial of service flaw was found in the way dhcpd     handled reference counting when processing client     requests. A malicious DHCP client could use this flaw     to trigger a reference count overflow on the server     side, potentially causing dhcpd to crash, by sending     large amounts of traffic.(CVE-2018-5733)

  - An out-of-bound memory access flaw was found in the way     dhclient processed a DHCP response packet. A malicious     DHCP server could potentially use this flaw to crash     dhclient processes running on DHCP client machines via     a crafted DHCP response packet.(CVE-2018-5732)

  - A resource-consumption flaw was discovered in the DHCP     server. dhcpd did not restrict the number of open     connections to OMAPI and failover ports. A remote     attacker able to establish TCP connections to one of     these ports could use this flaw to cause dhcpd to exit     unexpectedly, stop responding requests, or exhaust     system sockets (denial of service).(CVE-2016-2774)

  - It was found that the DHCP daemon did not properly     clean up closed OMAPI connections in certain cases. A     remote attacker able to connect to the OMAPI port could     use this flaw to exhaust file descriptors in the DHCP     daemon, leading to a denial of service in the OMAPI     functionality.(CVE-2017-3144)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the dhcp package has been released.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3586-1 advisory.

    Konstantin Orekhov discovered that the DHCP server incorrectly handled a large number of concurrent TCP     sessions. A remote attacker could possibly use this issue to cause a denial of service. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2774)

    It was discovered that the DHCP server incorrectly handled socket descriptors. A remote attacker could     possibly use this issue to cause a denial of service. (CVE-2017-3144)

    Felix Wilhelm discovered that the DHCP client incorrectly handled certain malformed responses. A remote     attacker could use this issue to cause the DHCP client to crash, resulting in a denial of service, or     possibly execute arbitrary code. In the default installation, attackers would be isolated by the dhclient     AppArmor profile. (CVE-2018-5732)

    Felix Wilhelm discovered that the DHCP server incorrectly handled reference counting. A remote attacker     could possibly use this issue to cause the DHCP server to crash, resulting in a denial of service.
    (CVE-2018-5733)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x     before 4.3.4 does not restrict the number of concurrent     TCP sessions, which allows remote attackers to cause a     denial of service (INSIST assertion failure or     request-processing outage) by establishing many     sessions.(CVE-2016-2774)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A resource-consumption flaw was discovered in the DHCP     server. dhcpd did not restrict the number of open     connections to OMAPI and failover ports. A remote     attacker able to establish TCP connections to one of     these ports could use this flaw to cause dhcpd to exit     unexpectedly, stop responding requests, or exhaust     system sockets (denial of service). (CVE-2016-2774)

Additional Changes :

An update for dhcp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.

Security Fix(es) :

* A resource-consumption flaw was discovered in the DHCP server. dhcpd did not restrict the number of open connections to OMAPI and failover ports. A remote attacker able to establish TCP connections to one of these ports could use this flaw to cause dhcpd to exit unexpectedly, stop responding requests, or exhaust system sockets (denial of service). (CVE-2016-2774)

Red Hat would like to thank ISC for reporting this issue.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2590 advisory.

    - unclosed TCP connections to OMAPI or failover ports can cause DoS (CVE-2016-2774)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for dhcp fixes the following issues :

  - CVE-2016-2774: Fixed a denial of service attack against     the DHCP server over the OMAPI TCP socket, which could     be used by network adjacent attackers to make the DHCP     server non-functional (bsc#969820).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dhcp fixes the following issues :

Security issue fixed :

  - CVE-2016-2774: Fixed a denial of service attack against     the DHCP server over the OMAPI TCP socket, which could     be used by network adjacent attackers to make the DHCP     server non-functional (bsc#969820).

Non security issues fixed :

  - Rename freeaddrinfo(), getaddrinfo() and getnameinfo()     in the internal libirs library that does not consider     /etc/hosts and /etc/nsswitch.conf to use irs_ prefix.
    This prevents name conflicts which would result in     overriding standard glibc functions used by libldap.
    (bsc#972907)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dhcp fixes the following issues :

Security issue fixed :

  - CVE-2016-2774: Fixed a denial of service attack against     the DHCP server over the OMAPI TCP socket, which could     be used by network adjacent attackers to make the DHCP     server non-functional (bsc#969820).

Non security issues fixed :

  - Rename freeaddrinfo(), getaddrinfo() and getnameinfo()     in the internal libirs library that does not consider     /etc/hosts and /etc/nsswitch.conf to use irs_ prefix.
    This prevents name conflicts which would result in     overriding standard glibc functions used by libldap.
    (bsc#972907)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Security fix for CVE-2016-2774

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release. Contains security fix for CVE-2016-2774.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-2774

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

RedHat Enterprise Linux 6 / 7 is affected by a denial of service vulnerability in the bundled ISC DHCP server due to a failure to properly restrict the number of concurrent TCP sessions to the ports the server uses for inter-process communications and control. An unauthenticated, remote attacker can exploit this, by opening a large number of TCP sessions, to cause the server to fail to process requests or to exit unexpectedly, or to cause an exhaustion of system sockets.

Note that this vulnerability is more easily exploited when the DHCP server is using OMAPI for remote management.

ID	Name	Product	Family	Severity
199472	RHEL 6 : dhcp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199428	RHEL 5 : dhcp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195571	RHEL 5 : dhcp (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195518	RHEL 6 : dhcp (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
131248	Debian DLA-2003-1 : isc-dhcp security update	Nessus	Debian Local Security Checks	medium
124946	EulerOS Virtualization 3.0.1.0 : dhcp (EulerOS-SA-2019-1443)	Nessus	Huawei Local Security Checks	high
121654	Photon OS 1.0: Dhcp PHSA-2016-0013	Nessus	PhotonOS Local Security Checks	medium
107117	Ubuntu 14.04 LTS / 16.04 LTS : DHCP vulnerabilities (USN-3586-1)	Nessus	Ubuntu Local Security Checks	high
99827	EulerOS 2.0 SP1 : dhcp (EulerOS-SA-2016-1065)	Nessus	Huawei Local Security Checks	medium
95836	Scientific Linux Security Update : dhcp on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	medium
95336	CentOS 7 : dhcp (CESA-2016:2590)	Nessus	CentOS Local Security Checks	medium
94711	Oracle Linux 7 : dhcp (ELSA-2016-2590)	Nessus	Oracle Linux Local Security Checks	medium
94553	RHEL 7 : dhcp (RHSA-2016:2590)	Nessus	Red Hat Local Security Checks	medium
93286	SUSE SLES11 Security Update : dhcp (SUSE-SU-2016:2024-1)	Nessus	SuSE Local Security Checks	medium
93181	SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2016:1791-1)	Nessus	SuSE Local Security Checks	medium
93176	SUSE SLES11 Security Update : dhcp (SUSE-SU-2016:1735-1)	Nessus	SuSE Local Security Checks	medium
93167	SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2016:1692-1)	Nessus	SuSE Local Security Checks	medium
92506	openSUSE Security Update : dhcp (openSUSE-2016-887)	Nessus	SuSE Local Security Checks	medium
92086	Fedora 22 : 12:dhcp (2016-3e64b32a91)	Nessus	Fedora Local Security Checks	medium
90962	Fedora 24 : dhcp-4.3.4-1.fc24 (2016-821f013cb1)	Nessus	Fedora Local Security Checks	medium
90901	Fedora 23 : dhcp-4.3.3-9.P1.fc23 (2016-c93d49faf3)	Nessus	Fedora Local Security Checks	medium
90250	RHEL 6 / 7 : ISC DHCP Concurrent TCP Sessions DoS	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2016-2774

medium

Tenable Plugins

medium

high

high

high

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high