OracleVM 3.3 : dhcp (OVMSA-2018-0024)

Medium Nessus Plugin ID 107249


The remote OracleVM host is missing one or more security updates.


The remote OracleVM system is missing necessary patches to address critical security updates :

- Added oracle-errwarn-message.patch

- Resolves: #1550085 - CVE-2018-5733 Avoid reference overflow


- Resolves: #1550083 - CVE-2018-5732 Avoid options buffer overflow

- Resolves: #1063217 - failover hangs with both potential-conflict

- Resolves: #1363790 - dhclient does not update routing table after the lease &nbsp expiry

- Resolves: #1321945 - dhclient hook script for Azure cloud

- send unicast request/release via correct interface (#1297445)

- Lease table overflow crash. (#1133917)

- Add ignore-client-uids option. (#1196768)

- dhclient-script: it's OK if the arping reply comes from our system. (#1204095)

- VLAN ID is only bottom 12-bits of TCI. (#1259552)

- dhclient: Make sure link-local address is ready in stateless mode. (#1263466)

- dhclient-script: make_resolv_conf: Keep old nameservers &nbsp if server sends domain-name/search, but no nameservers. (#1269595)

- Fix dhcrelay init script too. (#1187967)

- Actually take IB MAC address into account when creating seed (#1185075)

- Improve seeding the random number generator in dhclient (#1185075)

- Fix dhcrelay6 init script (#1187967)

- dhcrelay -6 was not working due to patch for #1001742 (#1151054)

- option 97 - pxe-client-id (#1058674)

- dhclient-script: PREINIT6: make sure link-local address is available (#1130804)

- dhcpd generates spurious responses when seeing requests &nbsp from vlans on plain interface (#1150587)

- Fix dhcpd/dhcrelay segfault if interface name longer than IFNAMSIZ (#1102662)

- Fix parsing of lease file dates & times on 64-bit platforms (#1099698)

- Fix dhcpd.leases reverting to root:root on every dhcpd start (#1067142) &nbsp New patch 'paranoia' merged with older 'paranoia-pid' patch

- Add init script for dhcrelay IPv6 version (#1053155)

- Fix handling of UDP packets with checksum 0xffff.

- Add GUIDs in the DHCP logs for IPoIB. (#1064416)

- Rotate the lease file when running in v6 mode.

- Resolves: #1001742 - dhclient: Make setsockopt not-fatal also for SO_REUSEPORT

- Resolves: #1001742 - dhclient: Bind socket to interface also for IPv6

- Don't crash on aliased infiniband interface. (#996518)

- various memory leaks in omapi (#978420)

- Modify the reply handling in the server code to send to a specified port &nbsp rather than to the source port for the incoming message. (#952126)

- Multiple key statements in zone definition causes inappropriate error (#919221)

- Make sure range6 is correct for subnet6 where it's declared (#902966)

- Relay no longer crashes, when DHCP packet is received over interface &nbsp without any IPv4 address assigned.

- Expose next-server DHCPv4 option to dhclient script.


Update the affected dhclient / dhcp-common packages.

See Also

Plugin Details

Severity: Medium

ID: 107249

File Name: oraclevm_OVMSA-2018-0024.nasl

Version: 1.4

Type: local

Published: 2018/03/09

Updated: 2019/09/27

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS v3.0

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:oracle:vm:dhclient, p-cpe:/a:oracle:vm:dhcp-common, cpe:/o:oracle:vm_server:3.3

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Patch Publication Date: 2018/03/08

Vulnerability Publication Date: 2019/01/16

Reference Information

CVE: CVE-2018-5732, CVE-2018-5733

IAVB: 2018-B-0034