Slackware Linux update for dhcp

1) Input validation error

EUVDB-ID: #VU33931

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2012-3955

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced.

Mitigation

Update the affected package dhcp.

Vulnerable software versions

Slackware Linux: 13.0 - 13.37

CPE2.3

• cpe:2.3:o:slackware:slackware_linux:13.0:*:*:*:*:*:*:*
• cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*
• cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.477093

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.