Resource exhaustion in DHCP - CVE-2017-3144

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU10031

Resource exhaustion in DHCP - CVE-2017-3144

Published: January 17, 2018


Vulnerability identifier: #VU10031
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-3144
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper cleaning up of closed OMAPI connections. A remote attacker who is permitted to establish connections to the OMAPI control port can trigger exhaustion of the pool of socket descriptors available to the DHCP server and cause the service to crash.

Affected software

DHCP
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Dell EMC PowerProtect Data Protection
Dynamic System Analysis (DSA) Preboot
Integrated Management Module II (IMM2) for BladeCenter Systems
SmartFabric OS10
System x Integrated Management Module (IMM2)
Flex System Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)

How to mitigate CVE-2017-3144

The recommended remedy is to disallow access to the OMAPI control port from unauthorized clients (in accordance with best practices for server operation).

Dell EMC PowerProtect Data Protection - update to 2.7.8
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
System x Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Flex System Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO84C-6.80-bc
Flex System Chassis Management Module (CMM) - update to 2pet16c-2.5.12c
SmartFabric OS10 - update to 10.5.6.1

External References

Related Security Bulletins