Input validation error in DHCP - CVE-2012-3955

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33931

Input validation error in DHCP - CVE-2012-3955

Published: September 14, 2012 / Updated: August 4, 2020


Vulnerability identifier: #VU33931
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-3955
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced.


Affected software

DHCP
Amazon Linux AMI
Ubuntu
Slackware Linux
dhcp (Alpine package)
dhcp3-server (Ubuntu package)
dhcp3-client (Ubuntu package)
isc-dhcp-client (Ubuntu package)
isc-dhcp-server (Ubuntu package)

How to mitigate CVE-2012-3955

Install update from vendor's website.

dhcp (Alpine package) - update to 4.2.4_p2-r0
dhcp3-server (Ubuntu package) - update to 3.1.3-2ubuntu3.4
dhcp3-client (Ubuntu package) - update to 3.1.3-2ubuntu3.4
isc-dhcp-client (Ubuntu package) - addressed in versions 4.1.1-P1-15ubuntu9.6, 4.1.1-P1-17ubuntu10.5, 4.1.ESV-R4-0ubuntu5.5
isc-dhcp-server (Ubuntu package) - addressed in versions 4.1.1-P1-15ubuntu9.6, 4.1.1-P1-17ubuntu10.5, 4.1.ESV-R4-0ubuntu5.5

External References

Related Security Bulletins