Amazon Linux AMI : dhcp (ALAS-2018-984)
Medium Nessus Plugin ID 108847
SynopsisThe remote Amazon Linux AMI host is missing a security update.
DescriptionBuffer overflow in dhclient possibly allowing code execution triggered by malicious server
An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client machines via a crafted DHCP response packet. (CVE-2018-5732)
Reference count overflow in dhcpd allows denial of service
A denial of service flaw was found in the way dhcpd handled reference counting when processing client requests. A malicious DHCP client could use this flaw to trigger a reference count overflow on the server side, potentially causing dhcpd to crash, by sending large amounts of traffic. (CVE-2018-5733)
SolutionRun 'yum update dhcp' to update your system.