PT-2016-5211 · Isc+5 · Isc Dhcp+5

Konstantin Orekhov · Published 2016-03-09 · Updated 2020-01-08 · CVE-2016-2774

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ISC DHCP versions 4.1.x through 4.1-ESV-R12 ISC DHCP versions 4.2.x through 4.3.3

Description The issue allows remote attackers to cause a denial of service by establishing many TCP sessions, due to the lack of restriction on the number of concurrent TCP sessions. This can lead to an INSIST assertion failure or a request-processing outage.

Recommendations For ISC DHCP versions 4.1.x through 4.1-ESV-R12, update to version 4.1-ESV-R13 or later. For ISC DHCP versions 4.2.x through 4.3.3, update to version 4.3.4 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-2138

CESA-2016_2590

CVE-2016-2774

DLA-2003-1

RHSA-2016:2590

RHSA-2016_2590

SUSE-SU-2016:1692-1

SUSE-SU-2016:1735-1

SUSE-SU-2016:1791-1

SUSE-SU-2016:2024-1

SUSE-SU-2016_1692-1

SUSE-SU-2016_1735-1

SUSE-SU-2016_1791-1

SUSE-SU-2016_2024-1

USN-3586-1

Affected Products

Alt Linux

Centos

Isc Dhcp

Red Hat

Suse

Ubuntu

References · 60

• https://bdu.fstec.ru/vul/2018-00357 · Security Note
• https://ubuntu.com/security/CVE-2017-3144 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2774 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3144 · Security Note
• https://ubuntu.com/security/CVE-2018-5732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2774 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5733 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2774 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2138 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2003-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2774 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8605 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:1692-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1735-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-07/msg00066.html · Vendor Advisory