Buffer overflow in dhclient possibly allowing code execution triggered by malicious server

An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client machines via a crafted DHCP response packet. (CVE-2018-5732)

Reference count overflow in dhcpd allows denial of service

A denial of service flaw was found in the way dhcpd handled reference counting when processing client requests. A malicious DHCP client could use this flaw to trigger a reference count overflow on the server side, potentially causing dhcpd to crash, by sending large amounts of traffic. (CVE-2018-5733)

The remote NewStart CGSL host, running version MAIN 5.04, has dhcp packages installed that are affected by multiple vulnerabilities:

  - An out-of-bound memory access flaw was found in the way     dhclient processed a DHCP response packet. A malicious     DHCP server could potentially use this flaw to crash     dhclient processes running on DHCP client machines via a     crafted DHCP response packet. (CVE-2018-5732)

  - A denial of service flaw was found in the way dhcpd     handled reference counting when processing client     requests. A malicious DHCP client could use this flaw to     trigger a reference count overflow on the server side,     potentially causing dhcpd to crash, by sending large     amounts of traffic. (CVE-2018-5733)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the dhcp package has been released.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2614:01 advisory.

    * dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server     (CVE-2018-5732)
      * dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ISC reports :

Failure to properly bounds check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section.

A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash.

Several vulnerabilities have been discovered in the ISC DHCP client, relay and server. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2017-3144     It was discovered that the DHCP server does not properly     clean up closed OMAPI connections, which can lead to     exhaustion of the pool of socket descriptors available     to the DHCP server, resulting in denial of service.

  - CVE-2018-5732     Felix Wilhelm of the Google Security Team discovered     that the DHCP client is prone to an out-of-bound memory     access vulnerability when processing specially     constructed DHCP options responses, resulting in     potential execution of arbitrary code by a malicious     DHCP server.

  - CVE-2018-5733     Felix Wilhelm of the Google Security Team discovered     that the DHCP server does not properly handle reference     counting when processing client requests. A malicious     client can take advantage of this flaw to cause a denial     of service (dhcpd crash) by sending large amounts of     traffic.

The DHCP server version installed on the remote host is 4.1.0 to 4.1-ESV-R15, or 4.2.0 to 4.2.8, or 4.3.0 to 4.3.6, or 4.4.0.
It is, therefore, vulnerable to a denial of service condition with in the omapi_connection_writer() function of the omapip/buffer.c script due to improper handling of an empty message. A local attacker could potentially exhaust the available descriptors.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Added oracle-errwarn-message.patch

  - Resolves: #1550085 - CVE-2018-5733 Avoid reference     overflow

<[12:4.1.1-53.P1.2

  - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer     overflow

  - Resolves: #1063217 - failover hangs with both     potential-conflict

  - Resolves: #1363790 - dhclient does not update routing     table after the lease &nbsp  expiry

  - Resolves: #1321945 - dhclient hook script for Azure     cloud

  - send unicast request/release via correct interface     (#1297445)

  - Lease table overflow crash. (#1133917)

  - Add ignore-client-uids option. (#1196768)

  - dhclient-script: it's OK if the arping reply comes from     our system. (#1204095)

  - VLAN ID is only bottom 12-bits of TCI. (#1259552)

  - dhclient: Make sure link-local address is ready in     stateless mode. (#1263466)

  - dhclient-script: make_resolv_conf: Keep old nameservers     &nbsp  if server sends domain-name/search, but no     nameservers. (#1269595)

  - Fix dhcrelay init script too. (#1187967)

  - Actually take IB MAC address into account when creating     seed (#1185075)

  - Improve seeding the random number generator in dhclient     (#1185075)

  - Fix dhcrelay6 init script (#1187967)

  - dhcrelay -6 was not working due to patch for #1001742     (#1151054)

  - option 97 - pxe-client-id (#1058674)

  - dhclient-script: PREINIT6: make sure link-local address     is available (#1130804)

  - dhcpd generates spurious responses when seeing requests     &nbsp  from vlans on plain interface (#1150587)

  - Fix dhcpd/dhcrelay segfault if interface name longer     than IFNAMSIZ (#1102662)

  - Fix parsing of lease file dates & times on 64-bit     platforms (#1099698)

  - Fix dhcpd.leases reverting to root:root on every dhcpd     start (#1067142) &nbsp  New patch 'paranoia' merged with     older 'paranoia-pid' patch

  - Add init script for dhcrelay IPv6 version (#1053155)

  - Fix handling of UDP packets with checksum 0xffff.
    (#1015997)

  - Add GUIDs in the DHCP logs for IPoIB. (#1064416)

  - Rotate the lease file when running in v6 mode.
    (#1053431)

  - Resolves: #1001742 - dhclient: Make setsockopt not-fatal     also for SO_REUSEPORT

  - Resolves: #1001742 - dhclient: Bind socket to interface     also for IPv6

  - Don't crash on aliased infiniband interface. (#996518)

  - various memory leaks in omapi (#978420)

  - Modify the reply handling in the server code to send to     a specified port &nbsp  rather than to the source port     for the incoming message. (#952126)

  - Multiple key statements in zone definition causes     inappropriate error (#919221)

  - Make sure range6 is correct for subnet6 where it's     declared (#902966)

  - Relay no longer crashes, when DHCP packet is received     over interface &nbsp  without any IPv4 address assigned.
    (#863936)

  - Expose next-server DHCPv4 option to dhclient script.
    (#658855)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0469 advisory.

    The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP     network to get their own network configuration information, including an IP address, a subnet mask, and a     broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and     administer DHCP on a network.

    Security Fix(es):

    * dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server     (CVE-2018-5732)

    * dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank ISC for reporting these issues. Upstream acknowledges Felix Wilhelm (Google)     as the original reporter of these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0483 advisory.

  - dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server     (CVE-2018-5732)

  - dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201804-05 (ISC DHCP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ISC DHCP. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could execute arbitrary code, cause a Denial of Service       condition, or have other unspecified impacts.
  Workaround :

    There are no known workarounds at this time for CVE-2018-5732 or       CVE-2018-5733.
    In accordance with upstream documentation, the recommended workaround       for CVE-2017-3144 is, &ldquo;to disallow access to the OMAPI control port       from unauthorized clients (in accordance with best practices for server       operation).&rdquo;

New dhcp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

Security fix for CVE-2018-5732 CVE-2018-5733

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for dhcp is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.

Security Fix(es) :

* dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server (CVE-2018-5732)

* dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank ISC for reporting these issues. Upstream acknowledges Felix Wilhelm (Google) as the original reporter of these issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0483 advisory.

    - Resolves: #1550000 - CVE-2018-5733  Avoid buffer overflow reference counter

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for dhcp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.

Security Fix(es) :

* dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server (CVE-2018-5732)

* dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank ISC for reporting these issues. Upstream acknowledges Felix Wilhelm (Google) as the original reporter of these issues.

This update for dhcp fixes the following issues :

Security issues fixed :

CVE-2018-5733: reference count overflow in dhcpd (bsc#1083303).

CVE-2018-5732: buffer overflow in dhclient (bsc#1083302).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or     an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by     sending a response containing a specially constructed options section. Affects ISC DHCP versions 4.1.0 ->     4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0 (CVE-2018-5732)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
109137	Amazon Linux 2 : dhcp (ALAS-2018-984)	Nessus	Amazon Linux Local Security Checks	2018/4/18	2024/10/30	high
127157	NewStart CGSL MAIN 5.04 : dhcp Multiple Vulnerabilities (NS-SA-2019-0010)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
131762	Photon OS 3.0: Dhcp PHSA-2019-3.0-0044	Nessus	PhotonOS Local Security Checks	2019/12/6	2025/8/22	high
289660	MiracleLinux 4 : dhcp-4.1.1-53.P1.3.0.1.AXS4 (AXSA:2018-2614:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
107126	FreeBSD : isc-dhcp -- Multiple vulnerabilities (2040c7f5-1e3a-11e8-8ae9-0050569f0b83)	Nessus	FreeBSD Local Security Checks	2018/3/5	2025/10/27	high
107199	Debian DSA-4133-1 : isc-dhcp - security update	Nessus	Debian Local Security Checks	2018/3/8	2025/10/24	high
107223	4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0 Multiple Vulnerabilities	Nessus	Misc.	2018/3/8	2021/10/25	high
107249	OracleVM 3.3 : dhcp (OVMSA-2018-0024)	Nessus	OracleVM Local Security Checks	2018/3/9	2025/10/24	high
107287	RHEL 6 : dhcp (RHSA-2018:0469)	Nessus	Red Hat Local Security Checks	2018/3/12	2025/10/24	high
108274	RHEL 7 : dhcp (RHSA-2018:0483)	Nessus	Red Hat Local Security Checks	2018/3/13	2025/2/4	high
108926	GLSA-201804-05 : ISC DHCP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/4/10	2024/11/12	high
107102	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : dhcp (SSA:2018-060-01)	Nessus	Slackware Local Security Checks	2018/3/2	2025/10/27	high
107138	Fedora 27 : 12:dhcp (2018-5051dbd15e)	Nessus	Fedora Local Security Checks	2018/3/6	2025/10/27	high
107275	CentOS 6 : dhcp (CESA-2018:0469)	Nessus	CentOS Local Security Checks	2018/3/12	2025/10/24	high
108273	Oracle Linux 7 : dhcp (ELSA-2018-0483)	Nessus	Oracle Linux Local Security Checks	2018/3/13	2025/2/4	high
108338	CentOS 7 : dhcp (CESA-2018:0483)	Nessus	CentOS Local Security Checks	2018/3/15	2025/1/31	high
118346	SUSE SLES11 Security Update : dhcp (SUSE-SU-2018:0810-2)	Nessus	SuSE Local Security Checks	2018/10/24	2024/7/29	high
221805	Linux Distros Unpatched Vulnerability : CVE-2018-5732	Nessus	Misc.	2025/3/4	2026/1/28	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high