PT-2024-13937 · Unknown · Simple-Dhcp-Server

Published 2024-04-29 · Updated 2024-11-20 · CVE-2023-50432

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions simple-dhcp-server through ec976d2

Description The issue allows remote attackers to cause a denial of service (daemon crash) by sending a DHCP packet without any option fields, which causes free packet in dhcp packet.c to dereference a NULL pointer. This can be triggered remotely, but there is no known exploit at this time.

Recommendations For simple-dhcp-server through ec976d2, as a temporary workaround, consider restricting access to the DHCP service until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2023-50432

Affected Products

Simple-Dhcp-Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-50432 · Security Note
• https://t.me/cvenotify/78485 · Telegram Post
• https://papers.mathyvanhoef.com/esorics2024.pdf · Note
• https://twitter.com/oktsec/status/1785195607302230275 · Twitter Post
• https://twitter.com/NUYTSTECH/status/1798456399086973071 · Twitter Post