ISC DHCP CVE-2018-5733 Remote Denial of Service Vulnerability

Bugtraq ID:	103188
Class:	Boundary Condition Error
CVE:	CVE-2018-5733
Remote:	Yes
Local:	No
Published:	Feb 28 2018 12:00AM
Updated:	Feb 28 2018 12:00AM
Credit:	Felix Wilhelm, Google Security Team
Vulnerable:	Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 ISC Dhcp 4.4 ISC Dhcp 4.3.6 ISC Dhcp 4.3 ISC Dhcp 4.2.8 ISC Dhcp 4.3.4 ISC Dhcp 4.3.3 P1 ISC Dhcp 4.3.3 ISC Dhcp 4.2.4 ISC Dhcp 4.2.3 ISC Dhcp 4.2.2 ISC Dhcp 4.2.1 ISC Dhcp 4.2.0 ISC Dhcp 4.1.2 P1 ISC Dhcp 4.1.2 ISC Dhcp 4.1.0 ISC Dhcp 4.1-ESV-R15 ISC Dhcp 4.1-ESV-R13 ISC Dhcp 4.1-ESV-R12-P1 ISC Dhcp 4.1-ESV-R12 P1 ISC Dhcp 4.1-Esv Rc1 ISC Dhcp 4.1-Esv R6 ISC Dhcp 4.1-Esv R5 Rc2 ISC Dhcp 4.1-Esv R5 Rc1 ISC Dhcp 4.1-Esv R5 B1 ISC Dhcp 4.1-Esv R5 ISC Dhcp 4.1-Esv R4 ISC Dhcp 4.1-Esv R3 B1 ISC Dhcp 4.1-Esv R3 ISC Dhcp 4.1-Esv R2 ISC Dhcp 4.1-Esv R1 ISC Dhcp 4.1-Esv
Not Vulnerable:	ISC Dhcp 4.4.1 ISC Dhcp 4.3.6-P1 ISC Dhcp 4.1-ESV-R15-P1

ISC DHCP CVE-2018-5733 Remote Denial of Service Vulnerability

ISC DHCP is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to exhaust the memory or crash the server, resulting in a denial-of-service condition.

DHCP 4.1.0 through 4.1-ESV-R15, 4.2.0 through 4.2.8, 4.3.0 through 4.3.6, and 4.4.0 are vulnerable.

ISC DHCP CVE-2018-5733 Remote Denial of Service Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ISC DHCP CVE-2018-5733 Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ISC DHCP CVE-2018-5733 Remote Denial of Service Vulnerability

References:

• ISC DHCP Homepage (ISC)
  
• Bug 1549961 CVE-2018-5733 dhcp: Reference count overflow in dhcpd allows DoS (Redhat)
  
• CVE-2018-5733 (Redhat)
  
• CVE-2018-5733: A malicious client can overflow a reference counter in ISC dhcpd (ISC)
  
• Oracle Solaris Third Party Bulletin - April 2018 (Oracle)