The DHCP server version installed on the remote host is 4.1.0 to 4.1-ESV-R15, or 4.2.0 to 4.2.8, or 4.3.0 to 4.3.6, or 4.4.0.
It is, therefore, vulnerable to a denial of service condition with in the omapi_connection_writer() function of the omapip/buffer.c script due to improper handling of an empty message. A local attacker could potentially exhaust the available descriptors.

This update for dhcp fixes the following issues :

Security issues fixed :

  - CVE-2018-5733: reference count overflow in dhcpd     (bsc#1083303).

  - CVE-2018-5732: buffer overflow in dhclient     (bsc#1083302).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The remote NewStart CGSL host, running version MAIN 5.04, has dhcp packages installed that are affected by multiple vulnerabilities:

  - An out-of-bound memory access flaw was found in the way     dhclient processed a DHCP response packet. A malicious     DHCP server could potentially use this flaw to crash     dhclient processes running on DHCP client machines via a     crafted DHCP response packet. (CVE-2018-5732)

  - A denial of service flaw was found in the way dhcpd     handled reference counting when processing client     requests. A malicious DHCP client could use this flaw to     trigger a reference count overflow on the server side,     potentially causing dhcpd to crash, by sending large     amounts of traffic. (CVE-2018-5733)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the dhcp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - DHCP (Dynamic Host Configuration Protocol) is a     protocol which allows individual devices on an IP     network to get their own network configuration     information (IP address, subnetmask, broadcast address,     etc.) from a DHCP server. The overall purpose of DHCP     is to make it easier to administer a large network. To     use DHCP on your network, install a DHCP service (or     relay agent), and on clients run a DHCP client daemon.
    The dhcp package provides the ISC DHCP service and     relay agent. Security Fix(es):In ISC DHCP 4.1-ESV-R1 ->     4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of     ISC DHCP (i.e., releases in the 4.0.x series or lower     and releases in the 4.3.x series) are beyond their     End-of-Life (EOL) and no longer supported by ISC. From     inspection it is clear that the defect is also present     in releases from those series, but they have not been     officially tested for the vulnerability), The outcome     of encountering the defect while reading a lease that     will trigger it varies, according to: the component     being affected (i.e., dhclient or dhcpd) whether the     package was built as a 32-bit or 64-bit binary whether     the compiler flag -fstack-protection-strong was used     when compiling In dhclient, ISC has not successfully     reproduced the error on a 64-bit system. However, on a     32-bit system it is possible to cause dhclient to crash     when reading an improper lease, which could cause     network connectivity problems for an affected system     due to the absence of a running DHCP client process. In     dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd     server binary was built for a 32-bit architecture AND     the -fstack-protection-strong flag was specified to the     compiler, dhcpd may exit while parsing a lease file     containing an objectionable lease, resulting in lack of     service to clients. Additionally, the offending lease     and the lease immediately following it in the lease     database may be improperly deleted. if the dhcpd server     binary was built for a 64-bit architecture OR if the
    -fstack-protection-strong compiler flag was NOT     specified, the crash will not occur, but it is possible     for the offending lease and the lease which immediately     followed it to be improperly     deleted.(CVE-2021-25217)Failure to properly     bounds-check a buffer used for processing DHCP options     allows a malicious server (or an entity masquerading as     a server) to cause a buffer overflow (and resulting     crash) in dhclient by sending a response containing a     specially constructed options section. Affects ISC DHCP     versions 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 ->     4.3.6, 4.4.0(CVE-2018-5732)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Buffer overflow in dhclient possibly allowing code execution triggered by malicious server

An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client machines via a crafted DHCP response packet. (CVE-2018-5732)

Reference count overflow in dhcpd allows denial of service

A denial of service flaw was found in the way dhcpd handled reference counting when processing client requests. A malicious DHCP client could use this flaw to trigger a reference count overflow on the server side, potentially causing dhcpd to crash, by sending large amounts of traffic. (CVE-2018-5733)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Added oracle-errwarn-message.patch

  - Resolves: #1550085 - CVE-2018-5733 Avoid reference     overflow

<[12:4.1.1-53.P1.2

  - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer     overflow

  - Resolves: #1063217 - failover hangs with both     potential-conflict

  - Resolves: #1363790 - dhclient does not update routing     table after the lease &nbsp  expiry

  - Resolves: #1321945 - dhclient hook script for Azure     cloud

  - send unicast request/release via correct interface     (#1297445)

  - Lease table overflow crash. (#1133917)

  - Add ignore-client-uids option. (#1196768)

  - dhclient-script: it's OK if the arping reply comes from     our system. (#1204095)

  - VLAN ID is only bottom 12-bits of TCI. (#1259552)

  - dhclient: Make sure link-local address is ready in     stateless mode. (#1263466)

  - dhclient-script: make_resolv_conf: Keep old nameservers     &nbsp  if server sends domain-name/search, but no     nameservers. (#1269595)

An update for dhcp is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.

Security Fix(es) :

* dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server (CVE-2018-5732)

* dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank ISC for reporting these issues. Upstream acknowledges Felix Wilhelm (Google) as the original reporter of these issues.

Security fix for CVE-2018-5732 CVE-2018-5733

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Added oracle-errwarn-message.patch

  - Resolves: #1570897 - Fix comamnd execution in NM script     (CVE-2018-1111)

  - Resolves: #1550085 - CVE-2018-5733 Avoid reference     overflow

<[12:4.1.1-53.P1.2

  - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer     overflow

  - Resolves: #1063217 - failover hangs with both     potential-conflict

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
107223	4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0 Multiple Vulnerabilities	Nessus	Misc.	2018/3/8	2021/10/25	high
108638	openSUSE Security Update : dhcp (openSUSE-2018-315)	Nessus	SuSE Local Security Checks	2018/3/27	2024/12/4	high
127157	NewStart CGSL MAIN 5.04 : dhcp Multiple Vulnerabilities (NS-SA-2019-0010)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
151348	EulerOS Virtualization for ARM 64 3.0.2.0 : dhcp (EulerOS-SA-2021-2077)	Nessus	Huawei Local Security Checks	2021/7/2	2023/12/11	high
108847	Amazon Linux AMI : dhcp (ALAS-2018-984)	Nessus	Amazon Linux Local Security Checks	2018/4/6	2024/11/20	high
109137	Amazon Linux 2 : dhcp (ALAS-2018-984)	Nessus	Amazon Linux Local Security Checks	2018/4/18	2024/10/30	high
107248	OracleVM 3.4 : dhcp (OVMSA-2018-0023)	Nessus	OracleVM Local Security Checks	2018/3/9	2025/10/24	high
107275	CentOS 6 : dhcp (CESA-2018:0469)	Nessus	CentOS Local Security Checks	2018/3/12	2025/10/24	high
107138	Fedora 27 : 12:dhcp (2018-5051dbd15e)	Nessus	Fedora Local Security Checks	2018/3/6	2025/10/27	high
109830	OracleVM 3.3 / 3.4 : dhcp (OVMSA-2018-0042)	Nessus	OracleVM Local Security Checks	2018/5/16	2025/4/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high