A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has dhcp packages installed that are affected by multiple vulnerabilities:

  - It was found that the DHCP daemon did not properly clean     up closed OMAPI connections in certain cases. A remote     attacker able to connect to the OMAPI port could use     this flaw to exhaust file descriptors in the DHCP     daemon, leading to a denial of service in the OMAPI     functionality. (CVE-2017-3144)

  - A command injection flaw was found in the NetworkManager     integration script included in the DHCP client packages     in Red Hat Enterprise Linux. A malicious DHCP server, or     an attacker on the local network able to spoof DHCP     responses, could use this flaw to execute arbitrary     commands with root privileges on systems using     NetworkManager and configured to obtain network     configuration using the DHCP protocol. (CVE-2018-1111)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the dhcp package has been released.

According to the versions of the dhcp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x     before 4.3.3-P1 allows remote attackers to cause a     denial of service (application crash) via an invalid     length field in a UDP IPv4 packet.(CVE-2015-8605)

  - A denial of service flaw was found in the way dhcpd     handled reference counting when processing client     requests. A malicious DHCP client could use this flaw     to trigger a reference count overflow on the server     side, potentially causing dhcpd to crash, by sending     large amounts of traffic.(CVE-2018-5733)

  - An out-of-bound memory access flaw was found in the way     dhclient processed a DHCP response packet. A malicious     DHCP server could potentially use this flaw to crash     dhclient processes running on DHCP client machines via     a crafted DHCP response packet.(CVE-2018-5732)

  - A resource-consumption flaw was discovered in the DHCP     server. dhcpd did not restrict the number of open     connections to OMAPI and failover ports. A remote     attacker able to establish TCP connections to one of     these ports could use this flaw to cause dhcpd to exit     unexpectedly, stop responding requests, or exhaust     system sockets (denial of service).(CVE-2016-2774)

  - It was found that the DHCP daemon did not properly     clean up closed OMAPI connections in certain cases. A     remote attacker able to connect to the OMAPI port could     use this flaw to exhaust file descriptors in the DHCP     daemon, leading to a denial of service in the OMAPI     functionality.(CVE-2017-3144)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the dhcp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was found that the DHCP daemon did not properly     clean up closed OMAPI connections in certain cases. A     remote attacker able to connect to the OMAPI port could     use this flaw to exhaust file descriptors in the DHCP     daemon, leading to a denial of service in the OMAPI     functionality.(CVE-2017-3144)

  - DHCP packages in Red Hat Enterprise Linux 6 and 7,     Fedora 28, and earlier are vulnerable to a command     injection flaw in the NetworkManager integration script     included in the DHCP client. A malicious DHCP server,     or an attacker on the local network able to spoof DHCP     responses, could use this flaw to execute arbitrary     commands with root privileges on systems using     NetworkManager and configured to obtain network     configuration using the DHCP protocol.(CVE-2018-1111)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the dhcp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was found that the DHCP daemon did not properly     clean up closed OMAPI connections in certain cases. A     remote attacker able to connect to the OMAPI port could     use this flaw to exhaust file descriptors in the DHCP     daemon, leading to a denial of service in the OMAPI     functionality. (CVE-2017-3144)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Omapi code doesn't free socket descriptors when empty message is received allowing denial-of-service

It was found that the DHCP daemon did not properly clean up closed OMAPI connections in certain cases. A remote attacker able to connect to the OMAPI port could use this flaw to exhaust file descriptors in the DHCP daemon, leading to a denial of service in the OMAPI functionality.(CVE-2017-3144)

The remote host is affected by the vulnerability described in GLSA-201804-05 (ISC DHCP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ISC DHCP. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could execute arbitrary code, cause a Denial of Service       condition, or have other unspecified impacts.
  Workaround :

    There are no known workarounds at this time for CVE-2018-5732 or       CVE-2018-5733.
    In accordance with upstream documentation, the recommended workaround       for CVE-2017-3144 is, &ldquo;to disallow access to the OMAPI control port       from unauthorized clients (in accordance with best practices for server       operation).&rdquo;

Several vulnerabilities have been discovered in the ISC DHCP client, relay and server. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2017-3144     It was discovered that the DHCP server does not properly     clean up closed OMAPI connections, which can lead to     exhaustion of the pool of socket descriptors available     to the DHCP server, resulting in denial of service.

  - CVE-2018-5732     Felix Wilhelm of the Google Security Team discovered     that the DHCP client is prone to an out-of-bound memory     access vulnerability when processing specially     constructed DHCP options responses, resulting in     potential execution of arbitrary code by a malicious     DHCP server.

  - CVE-2018-5733     Felix Wilhelm of the Google Security Team discovered     that the DHCP server does not properly handle reference     counting when processing client requests. A malicious     client can take advantage of this flaw to cause a denial     of service (dhcpd crash) by sending large amounts of     traffic.

Konstantin Orekhov discovered that the DHCP server incorrectly handled a large number of concurrent TCP sessions. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2774)

It was discovered that the DHCP server incorrectly handled socket descriptors. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2017-3144)

Felix Wilhelm discovered that the DHCP client incorrectly handled certain malformed responses. A remote attacker could use this issue to cause the DHCP client to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, attackers would be isolated by the dhclient AppArmor profile.
(CVE-2018-5732)

Felix Wilhelm discovered that the DHCP server incorrectly handled reference counting. A remote attacker could possibly use this issue to cause the DHCP server to crash, resulting in a denial of service.
(CVE-2018-5733).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dhcp fixes several issues. This security issue was fixed :

  - CVE-2017-3144: OMAPI code didn't free socket descriptors     when empty message is received allowing DoS     (bsc#1076119).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dhcp fixes several issues.

This security issue was fixed :

  - CVE-2017-3144: OMAPI code didn't free socket descriptors     when empty message is received allowing DoS     (bsc#1076119).

These non-security issues were fixed :

  - Optimized if and when DNS client context and ports are     initted (bsc#1073935)

  - Relax permission of dhclient-script for libguestfs     (bsc#987170)

  - Modify dhclient-script to handle static route updates     (bsc#1023415).

  - Use only the 12 least significant bits of an inbound     packet's TCI value as the VLAN ID to fix some packages     being wrongly discarded by the Linux packet filter.
    (bsc#1059061)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for dhcp fixes several issues. This security issue was fixed :

  - CVE-2017-3144: OMAPI code didn't free socket descriptors     when empty message is received allowing DoS     (bsc#1076119)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that the DHCP daemon did not properly     clean up closed OMAPI connections in certain cases. A     remote attacker able to connect to the OMAPI port could     use this flaw to exhaust file descriptors in the DHCP     daemon, leading to a denial of service in the OMAPI     functionality. (CVE-2017-3144)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2018:0158 :

An update for dhcp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.

Security Fix(es) :

* It was found that the DHCP daemon did not properly clean up closed OMAPI connections in certain cases. A remote attacker able to connect to the OMAPI port could use this flaw to exhaust file descriptors in the DHCP daemon, leading to a denial of service in the OMAPI functionality. (CVE-2017-3144)

An update for dhcp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.

Security Fix(es) :

* It was found that the DHCP daemon did not properly clean up closed OMAPI connections in certain cases. A remote attacker able to connect to the OMAPI port could use this flaw to exhaust file descriptors in the DHCP daemon, leading to a denial of service in the OMAPI functionality. (CVE-2017-3144)

Security Fix(es) :

  - It was found that the DHCP daemon did not properly clean     up closed OMAPI connections in certain cases. A remote     attacker able to connect to the OMAPI port could use     this flaw to exhaust file descriptors in the DHCP     daemon, leading to a denial of service in the OMAPI     functionality. (CVE-2017-3144)

The DHCP server version installed on the remote host is 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, or 4.3.0 to 4.3.6. It is, therefore, vulnerable to a denial of service condition with in the omapi_connection_writer() function of the omapip/buffer.c script due to improper handling of an empty message. A local attacker could potentially exhaust the available descriptors.

ID	Name	Product	Family	Severity
127178	NewStart CGSL CORE 5.04 / MAIN 5.04 : dhcp Multiple Vulnerabilities (NS-SA-2019-0021)	Nessus	NewStart CGSL Local Security Checks	high
126213	Photon OS 2.0: Dhcp PHSA-2019-2.0-0152	Nessus	PhotonOS Local Security Checks	high
124946	EulerOS Virtualization 3.0.1.0 : dhcp (EulerOS-SA-2019-1443)	Nessus	Huawei Local Security Checks	high
124882	EulerOS Virtualization for ARM 64 3.0.1.0 : dhcp (EulerOS-SA-2019-1379)	Nessus	Huawei Local Security Checks	high
117550	EulerOS Virtualization 2.5.0 : dhcp (EulerOS-SA-2018-1241)	Nessus	Huawei Local Security Checks	high
109131	Amazon Linux 2 : dhcp (ALAS-2018-963)	Nessus	Amazon Linux Local Security Checks	high
108926	GLSA-201804-05 : ISC DHCP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
107199	Debian DSA-4133-1 : isc-dhcp - security update	Nessus	Debian Local Security Checks	high
107117	Ubuntu 14.04 LTS / 16.04 LTS : DHCP vulnerabilities (USN-3586-1)	Nessus	Ubuntu Local Security Checks	high
107002	SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2018:0532-1)	Nessus	SuSE Local Security Checks	high
106998	openSUSE Security Update : dhcp (openSUSE-2018-207)	Nessus	SuSE Local Security Checks	high
106836	SUSE SLES11 Security Update : dhcp (SUSE-SU-2018:0444-1)	Nessus	SuSE Local Security Checks	high
106764	EulerOS 2.0 SP2 : dhcp (EulerOS-SA-2018-1036)	Nessus	Huawei Local Security Checks	high
106763	EulerOS 2.0 SP1 : dhcp (EulerOS-SA-2018-1035)	Nessus	Huawei Local Security Checks	high
106365	Oracle Linux 7 : dhcp (ELSA-2018-0158)	Nessus	Oracle Linux Local Security Checks	high
106354	CentOS 7 : dhcp (CESA-2018:0158)	Nessus	CentOS Local Security Checks	high
106339	Scientific Linux Security Update : dhcp on SL7.x x86_64 (20180125)	Nessus	Scientific Linux Local Security Checks	high
106332	RHEL 7 : dhcp (RHSA-2018:0158)	Nessus	Red Hat Local Security Checks	high
106202	ISC DHCP 4.1.0 to 4.1-ESV-R15 / 4.2.0 to 4.2.8 / 4.3.0 to 4.3.6 DoS vulnerability	Nessus	Misc.	high

Detections

Analytics

CVE-2017-3144

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high