Buffer overflow in DHCP - CVE-2018-5732

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU10790

Buffer overflow in DHCP - CVE-2018-5732

Published: March 1, 2018


Vulnerability identifier: #VU10790
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5732
CWE-ID: CWE-120
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the dhclient due to buffer overflow. A remote attacker can send specially crafted response, trigger memory corruption and cause the service to crash.

Affected software

DHCP
Arch Linux
Debian Linux
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Slackware Linux
Fedora
Dell EMC PowerProtect Data Protection
Dynamic System Analysis (DSA) Preboot
IBM System Storage TS4500 Tape Library
EMC Atmos
SmartFabric OS10
dhcp (Alpine package)
dhcp
Flex System Chassis Management Module (CMM)
SAN Volume Controller and Storwize Family

How to mitigate CVE-2018-5732

Update to versions 4.1-ESV-R15-P1, 4.3.6-P1 or 4.4.1.

Dell EMC PowerProtect Data Protection - update to 2.7.8
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
IBM System Storage TS4500 Tape Library - update to 1.4.1.2
Flex System Chassis Management Module (CMM) - update to 2pet16c-2.5.12c
EMC Atmos - addressed in versions 2.4.2 HF504, 2.4.3 HF504
dhcp - update to 4.3.6-9.fc27
SAN Volume Controller and Storwize Family - addressed in versions 7.8.1.8, 8.1.3.3, 8.2.0.0, 8.2.1.0
SmartFabric OS10 - update to 10.5.6.1

External References

Related Security Bulletins