The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3146 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-3146-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     October 11, 2022                            https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : isc-dhcp     Version        : 4.4.1-2+deb10u2     CVE ID         : CVE-2022-2928 CVE-2022-2929     Debian Bug     : 1021320

    Several vulnerabilities have been discovered in the ISC DHCP client,     relay and server.

    CVE-2022-2928

        It was discovered that the DHCP server does not correctly perform         option reference counting when configured with allow leasequery;.
        A remote attacker can take advantage of this flaw to cause a denial         of service (daemon crash).

    CVE-2022-2929

        It was discovered that the DHCP server is prone to a memory leak         flaw when handling contents of option 81 (fqdn) data received in         a DHCP packet. A remote attacker can take advantage of this flaw         to cause DHCP servers to consume resources, resulting in denial         of service.

    For Debian 10 buster, these problems have been fixed in version     4.4.1-2+deb10u2.

    We recommend that you upgrade your isc-dhcp packages.

    For the detailed security status of isc-dhcp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/isc-dhcp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3146 : isc-dhcp-client - security update

medium Nessus Plugin ID 166004

Version 1.4