OracleVM 3.3 : dhcp (OVMSA-2018-0024)

high Nessus Plugin ID 107249

Language:

Synopsis

The remote OracleVM host is missing one or more security updates.

Description

The remote OracleVM system is missing necessary patches to address critical security updates :

- Added oracle-errwarn-message.patch

- Resolves: #1550085 - CVE-2018-5733 Avoid reference overflow

<[12:4.1.1-53.P1.2

- Resolves: #1550083 - CVE-2018-5732 Avoid options buffer overflow

- Resolves: #1063217 - failover hangs with both potential-conflict

- Resolves: #1363790 - dhclient does not update routing table after the lease &nbsp expiry

- Resolves: #1321945 - dhclient hook script for Azure cloud

- send unicast request/release via correct interface (#1297445)

- Lease table overflow crash. (#1133917)

- Add ignore-client-uids option. (#1196768)

- dhclient-script: it's OK if the arping reply comes from our system. (#1204095)

- VLAN ID is only bottom 12-bits of TCI. (#1259552)

- dhclient: Make sure link-local address is ready in stateless mode. (#1263466)

- dhclient-script: make_resolv_conf: Keep old nameservers &nbsp if server sends domain-name/search, but no nameservers. (#1269595)

- Fix dhcrelay init script too. (#1187967)

- Actually take IB MAC address into account when creating seed (#1185075)

- Improve seeding the random number generator in dhclient (#1185075)

- Fix dhcrelay6 init script (#1187967)

- dhcrelay -6 was not working due to patch for #1001742 (#1151054)

- option 97 - pxe-client-id (#1058674)

- dhclient-script: PREINIT6: make sure link-local address is available (#1130804)

- dhcpd generates spurious responses when seeing requests &nbsp from vlans on plain interface (#1150587)

- Fix dhcpd/dhcrelay segfault if interface name longer than IFNAMSIZ (#1102662)

- Fix parsing of lease file dates & times on 64-bit platforms (#1099698)

- Fix dhcpd.leases reverting to root:root on every dhcpd start (#1067142) &nbsp New patch 'paranoia' merged with older 'paranoia-pid' patch

- Add init script for dhcrelay IPv6 version (#1053155)

- Fix handling of UDP packets with checksum 0xffff.
(#1015997)

- Add GUIDs in the DHCP logs for IPoIB. (#1064416)

- Rotate the lease file when running in v6 mode.
(#1053431)

- Resolves: #1001742 - dhclient: Make setsockopt not-fatal also for SO_REUSEPORT

- Resolves: #1001742 - dhclient: Bind socket to interface also for IPv6

- Don't crash on aliased infiniband interface. (#996518)

- various memory leaks in omapi (#978420)

- Modify the reply handling in the server code to send to a specified port &nbsp rather than to the source port for the incoming message. (#952126)

- Multiple key statements in zone definition causes inappropriate error (#919221)

- Make sure range6 is correct for subnet6 where it's declared (#902966)

- Relay no longer crashes, when DHCP packet is received over interface &nbsp without any IPv4 address assigned.
(#863936)

- Expose next-server DHCPv4 option to dhclient script.
(#658855)

Solution

Update the affected dhclient / dhcp-common packages.

Plugin Details

Severity: High

ID: 107249

File Name: oraclevm_OVMSA-2018-0024.nasl

Version: 1.6

Type: local

Family: OracleVM Local Security Checks

Published: 3/9/2018

Updated: 10/24/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2018-5733

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:oracle:vm:dhcp-common, cpe:/o:oracle:vm_server:3.3, p-cpe:/a:oracle:vm:dhclient

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 3/8/2018

Vulnerability Publication Date: 1/16/2019

Reference Information

CVE: CVE-2018-5732, CVE-2018-5733

IAVB: 2018-B-0034-S

Detections

Analytics