Detections
Analytics

OracleVM 3.4 : dhcp (OVMSA-2018-0023)

high Nessus Plugin ID 107248

Language:

Synopsis

The remote OracleVM host is missing one or more security updates.

Description

The remote OracleVM system is missing necessary patches to address critical security updates :

 - Added oracle-errwarn-message.patch

 - Resolves: #1550085 - CVE-2018-5733 Avoid reference overflow

<[12:4.1.1-53.P1.2

 - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer overflow

 - Resolves: #1063217 - failover hangs with both potential-conflict

 - Resolves: #1363790 - dhclient does not update routing table after the lease &nbsp expiry

 - Resolves: #1321945 - dhclient hook script for Azure cloud

 - send unicast request/release via correct interface (#1297445)

 - Lease table overflow crash. (#1133917)

 - Add ignore-client-uids option. (#1196768)

 - dhclient-script: it's OK if the arping reply comes from our system. (#1204095)

 - VLAN ID is only bottom 12-bits of TCI. (#1259552)

 - dhclient: Make sure link-local address is ready in stateless mode. (#1263466)

 - dhclient-script: make_resolv_conf: Keep old nameservers &nbsp if server sends domain-name/search, but no nameservers. (#1269595)

Solution

Update the affected dhclient / dhcp-common packages.

See Also

http://www.nessus.org/u?cf73ec61

Plugin Details

Severity: High

ID: 107248

File Name: oraclevm_OVMSA-2018-0023.nasl

Version: 1.5

Type: local

Published: 3/9/2018

Updated: 7/10/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:oracle:vm:dhclient, p-cpe:/a:oracle:vm:dhcp-common, cpe:/o:oracle:vm_server:3.4

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Patch Publication Date: 3/8/2018

Vulnerability Publication Date: 1/16/2019

Reference Information

CVE: CVE-2018-5732, CVE-2018-5733

IAVB: 2018-B-0034-S