Detections
Analytics

OracleVM 3.3 : dhcp (OVMSA-2018-0024)

high Nessus Plugin ID 107249

Language:

Synopsis

The remote OracleVM host is missing one or more security updates.

Description

The remote OracleVM system is missing necessary patches to address critical security updates :

 - Added oracle-errwarn-message.patch

 - Resolves: #1550085 - CVE-2018-5733 Avoid reference overflow

<[12:4.1.1-53.P1.2

 - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer overflow

 - Resolves: #1063217 - failover hangs with both potential-conflict

 - Resolves: #1363790 - dhclient does not update routing table after the lease &nbsp expiry

 - Resolves: #1321945 - dhclient hook script for Azure cloud

 - send unicast request/release via correct interface (#1297445)

 - Lease table overflow crash. (#1133917)

 - Add ignore-client-uids option. (#1196768)

 - dhclient-script: it's OK if the arping reply comes from our system. (#1204095)

 - VLAN ID is only bottom 12-bits of TCI. (#1259552)

 - dhclient: Make sure link-local address is ready in stateless mode. (#1263466)

 - dhclient-script: make_resolv_conf: Keep old nameservers &nbsp if server sends domain-name/search, but no nameservers. (#1269595)

 - Fix dhcrelay init script too. (#1187967)

 - Actually take IB MAC address into account when creating seed (#1185075)

 - Improve seeding the random number generator in dhclient (#1185075)

 - Fix dhcrelay6 init script (#1187967)

 - dhcrelay -6 was not working due to patch for #1001742 (#1151054)

 - option 97 - pxe-client-id (#1058674)

 - dhclient-script: PREINIT6: make sure link-local address is available (#1130804)

 - dhcpd generates spurious responses when seeing requests &nbsp from vlans on plain interface (#1150587)

 - Fix dhcpd/dhcrelay segfault if interface name longer than IFNAMSIZ (#1102662)

 - Fix parsing of lease file dates & times on 64-bit platforms (#1099698)

 - Fix dhcpd.leases reverting to root:root on every dhcpd start (#1067142) &nbsp New patch 'paranoia' merged with older 'paranoia-pid' patch

 - Add init script for dhcrelay IPv6 version (#1053155)

 - Fix handling of UDP packets with checksum 0xffff.
 (#1015997)

 - Add GUIDs in the DHCP logs for IPoIB. (#1064416)

 - Rotate the lease file when running in v6 mode.
 (#1053431)

 - Resolves: #1001742 - dhclient: Make setsockopt not-fatal also for SO_REUSEPORT

 - Resolves: #1001742 - dhclient: Bind socket to interface also for IPv6

 - Don't crash on aliased infiniband interface. (#996518)

 - various memory leaks in omapi (#978420)

 - Modify the reply handling in the server code to send to a specified port &nbsp rather than to the source port for the incoming message. (#952126)

 - Multiple key statements in zone definition causes inappropriate error (#919221)

 - Make sure range6 is correct for subnet6 where it's declared (#902966)

 - Relay no longer crashes, when DHCP packet is received over interface &nbsp without any IPv4 address assigned.
 (#863936)

 - Expose next-server DHCPv4 option to dhclient script.
 (#658855)

Solution

Update the affected dhclient / dhcp-common packages.

See Also

http://www.nessus.org/u?57dbebd9

Plugin Details

Severity: High

ID: 107249

File Name: oraclevm_OVMSA-2018-0024.nasl

Version: 1.5

Type: local

Published: 3/9/2018

Updated: 7/10/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:oracle:vm:dhclient, p-cpe:/a:oracle:vm:dhcp-common, cpe:/o:oracle:vm_server:3.3

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Patch Publication Date: 3/8/2018

Vulnerability Publication Date: 1/16/2019

Reference Information

CVE: CVE-2018-5732, CVE-2018-5733

IAVB: 2018-B-0034-S