ISC reports :

Failure to properly bounds check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section.

A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash.

Several vulnerabilities have been discovered in the ISC DHCP client, relay and server. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2017-3144     It was discovered that the DHCP server does not properly     clean up closed OMAPI connections, which can lead to     exhaustion of the pool of socket descriptors available     to the DHCP server, resulting in denial of service.

  - CVE-2018-5732     Felix Wilhelm of the Google Security Team discovered     that the DHCP client is prone to an out-of-bound memory     access vulnerability when processing specially     constructed DHCP options responses, resulting in     potential execution of arbitrary code by a malicious     DHCP server.

  - CVE-2018-5733     Felix Wilhelm of the Google Security Team discovered     that the DHCP server does not properly handle reference     counting when processing client requests. A malicious     client can take advantage of this flaw to cause a denial     of service (dhcpd crash) by sending large amounts of     traffic.

The DHCP server version installed on the remote host is 4.1.0 to 4.1-ESV-R15, or 4.2.0 to 4.2.8, or 4.3.0 to 4.3.6, or 4.4.0.
It is, therefore, vulnerable to a denial of service condition with in the omapi_connection_writer() function of the omapip/buffer.c script due to improper handling of an empty message. A local attacker could potentially exhaust the available descriptors.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Added oracle-errwarn-message.patch

  - Resolves: #1550085 - CVE-2018-5733 Avoid reference     overflow

<[12:4.1.1-53.P1.2

  - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer     overflow

  - Resolves: #1063217 - failover hangs with both     potential-conflict

  - Resolves: #1363790 - dhclient does not update routing     table after the lease &nbsp  expiry

  - Resolves: #1321945 - dhclient hook script for Azure     cloud

  - send unicast request/release via correct interface     (#1297445)

  - Lease table overflow crash. (#1133917)

  - Add ignore-client-uids option. (#1196768)

  - dhclient-script: it's OK if the arping reply comes from     our system. (#1204095)

  - VLAN ID is only bottom 12-bits of TCI. (#1259552)

  - dhclient: Make sure link-local address is ready in     stateless mode. (#1263466)

  - dhclient-script: make_resolv_conf: Keep old nameservers     &nbsp  if server sends domain-name/search, but no     nameservers. (#1269595)

  - Fix dhcrelay init script too. (#1187967)

  - Actually take IB MAC address into account when creating     seed (#1185075)

  - Improve seeding the random number generator in dhclient     (#1185075)

  - Fix dhcrelay6 init script (#1187967)

  - dhcrelay -6 was not working due to patch for #1001742     (#1151054)

  - option 97 - pxe-client-id (#1058674)

  - dhclient-script: PREINIT6: make sure link-local address     is available (#1130804)

  - dhcpd generates spurious responses when seeing requests     &nbsp  from vlans on plain interface (#1150587)

  - Fix dhcpd/dhcrelay segfault if interface name longer     than IFNAMSIZ (#1102662)

  - Fix parsing of lease file dates & times on 64-bit     platforms (#1099698)

  - Fix dhcpd.leases reverting to root:root on every dhcpd     start (#1067142) &nbsp  New patch 'paranoia' merged with     older 'paranoia-pid' patch

  - Add init script for dhcrelay IPv6 version (#1053155)

  - Fix handling of UDP packets with checksum 0xffff.
    (#1015997)

  - Add GUIDs in the DHCP logs for IPoIB. (#1064416)

  - Rotate the lease file when running in v6 mode.
    (#1053431)

  - Resolves: #1001742 - dhclient: Make setsockopt not-fatal     also for SO_REUSEPORT

  - Resolves: #1001742 - dhclient: Bind socket to interface     also for IPv6

  - Don't crash on aliased infiniband interface. (#996518)

  - various memory leaks in omapi (#978420)

  - Modify the reply handling in the server code to send to     a specified port &nbsp  rather than to the source port     for the incoming message. (#952126)

  - Multiple key statements in zone definition causes     inappropriate error (#919221)

  - Make sure range6 is correct for subnet6 where it's     declared (#902966)

  - Relay no longer crashes, when DHCP packet is received     over interface &nbsp  without any IPv4 address assigned.
    (#863936)

  - Expose next-server DHCPv4 option to dhclient script.
    (#658855)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0469 advisory.

    The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP     network to get their own network configuration information, including an IP address, a subnet mask, and a     broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and     administer DHCP on a network.

    Security Fix(es):

    * dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server     (CVE-2018-5732)

    * dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank ISC for reporting these issues. Upstream acknowledges Felix Wilhelm (Google)     as the original reporter of these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0483 advisory.

  - dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server     (CVE-2018-5732)

  - dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201804-05 (ISC DHCP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ISC DHCP. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could execute arbitrary code, cause a Denial of Service       condition, or have other unspecified impacts.
  Workaround :

    There are no known workarounds at this time for CVE-2018-5732 or       CVE-2018-5733.
    In accordance with upstream documentation, the recommended workaround       for CVE-2017-3144 is, &ldquo;to disallow access to the OMAPI control port       from unauthorized clients (in accordance with best practices for server       operation).&rdquo;

An update of the dhcp package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP     server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC     DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0. (CVE-2018-5733)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the dhcp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bound memory access flaw was found in the way     dhclient processed a DHCP response packet. A malicious     DHCP server could potentially use this flaw to crash     dhclient processes running on DHCP client machines via     a crafted DHCP response packet.(CVE-2018-5732)

  - A denial of service flaw was found in the way dhcpd     handled reference counting when processing client     requests. A malicious DHCP client could use this flaw     to trigger a reference count overflow on the server     side, potentially causing dhcpd to crash, by sending     large amounts of traffic.(CVE-2018-5733)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the dhcp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x     before 4.3.3-P1 allows remote attackers to cause a     denial of service (application crash) via an invalid     length field in a UDP IPv4 packet.(CVE-2015-8605)

  - A denial of service flaw was found in the way dhcpd     handled reference counting when processing client     requests. A malicious DHCP client could use this flaw     to trigger a reference count overflow on the server     side, potentially causing dhcpd to crash, by sending     large amounts of traffic.(CVE-2018-5733)

  - An out-of-bound memory access flaw was found in the way     dhclient processed a DHCP response packet. A malicious     DHCP server could potentially use this flaw to crash     dhclient processes running on DHCP client machines via     a crafted DHCP response packet.(CVE-2018-5732)

  - A resource-consumption flaw was discovered in the DHCP     server. dhcpd did not restrict the number of open     connections to OMAPI and failover ports. A remote     attacker able to establish TCP connections to one of     these ports could use this flaw to cause dhcpd to exit     unexpectedly, stop responding requests, or exhaust     system sockets (denial of service).(CVE-2016-2774)

  - It was found that the DHCP daemon did not properly     clean up closed OMAPI connections in certain cases. A     remote attacker able to connect to the OMAPI port could     use this flaw to exhaust file descriptors in the DHCP     daemon, leading to a denial of service in the OMAPI     functionality.(CVE-2017-3144)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dhcp fixes the following issues: Security issues fixed :

  - CVE-2018-5733: reference count overflow in dhcpd     (bsc#1083303).

  - CVE-2018-5732: buffer overflow in dhclient     (bsc#1083302).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Buffer overflow in dhclient possibly allowing code execution triggered by malicious server

An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client machines via a crafted DHCP response packet. (CVE-2018-5732)

Reference count overflow in dhcpd allows denial of service

A denial of service flaw was found in the way dhcpd handled reference counting when processing client requests. A malicious DHCP client could use this flaw to trigger a reference count overflow on the server side, potentially causing dhcpd to crash, by sending large amounts of traffic. (CVE-2018-5733)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bound memory access flaw was found in the way     dhclient processed a DHCP response packet. A malicious     DHCP server could potentially use this flaw to crash     dhclient processes running on DHCP client machines via     a crafted DHCP response packet.(CVE-2018-5732)

  - A denial of service flaw was found in the way dhcpd     handled reference counting when processing client     requests. A malicious DHCP client could use this flaw     to trigger a reference count overflow on the server     side, potentially causing dhcpd to crash, by sending     large amounts of traffic.(CVE-2018-5733)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2613:02 advisory.

    * dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server     (CVE-2018-5732)
      * dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Added oracle-errwarn-message.patch

  - Resolves: #1570897 - Fix comamnd execution in NM script     (CVE-2018-1111)

  - Resolves: #1550085 - CVE-2018-5733 Avoid reference     overflow

<[12:4.1.1-53.P1.2

  - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer     overflow

  - Resolves: #1063217 - failover hangs with both     potential-conflict

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
107126	FreeBSD : isc-dhcp -- Multiple vulnerabilities (2040c7f5-1e3a-11e8-8ae9-0050569f0b83)	Nessus	FreeBSD Local Security Checks	2018/3/5	2025/10/27	high
107199	Debian DSA-4133-1 : isc-dhcp - security update	Nessus	Debian Local Security Checks	2018/3/8	2025/10/24	high
107223	4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0 Multiple Vulnerabilities	Nessus	Misc.	2018/3/8	2021/10/25	high
107249	OracleVM 3.3 : dhcp (OVMSA-2018-0024)	Nessus	OracleVM Local Security Checks	2018/3/9	2025/10/24	high
107287	RHEL 6 : dhcp (RHSA-2018:0469)	Nessus	Red Hat Local Security Checks	2018/3/12	2025/10/24	high
108274	RHEL 7 : dhcp (RHSA-2018:0483)	Nessus	Red Hat Local Security Checks	2018/3/13	2025/2/4	high
108926	GLSA-201804-05 : ISC DHCP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/4/10	2024/11/12	high
202774	Photon OS 3.0: Dhcp PHSA-2019-3.0-0016	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/24	high
221911	Linux Distros Unpatched Vulnerability : CVE-2018-5733	Nessus	Misc.	2025/3/4	2026/1/28	high
117559	EulerOS Virtualization 2.5.0 : dhcp (EulerOS-SA-2018-1250)	Nessus	Huawei Local Security Checks	2018/9/18	2024/8/7	high
124946	EulerOS Virtualization 3.0.1.0 : dhcp (EulerOS-SA-2019-1443)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	high
108655	SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2018:0812-1)	Nessus	SuSE Local Security Checks	2018/3/27	2024/12/3	high
108847	Amazon Linux AMI : dhcp (ALAS-2018-984)	Nessus	Amazon Linux Local Security Checks	2018/4/6	2024/11/20	high
109470	EulerOS 2.0 SP1 : dhcp (EulerOS-SA-2018-1072)	Nessus	Huawei Local Security Checks	2018/5/2	2024/10/15	high
109471	EulerOS 2.0 SP2 : dhcp (EulerOS-SA-2018-1073)	Nessus	Huawei Local Security Checks	2018/5/2	2024/10/15	high
289974	MiracleLinux 7 : dhcp-4.2.5-58.3.0.1.el7.AXS7 (AXSA:2018-2613:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
109830	OracleVM 3.3 / 3.4 : dhcp (OVMSA-2018-0042)	Nessus	OracleVM Local Security Checks	2018/5/16	2025/4/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high