There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bindUpgrade dhcp | Mar 26, 2024 | Nov 1, 2019 |
| Amazon Linux Ami 2 | — | Upgrade dhcp-commonUpgrade dhcp-debuginfoUpgrade dhcp-develUpgrade dhcpUpgrade dhcp-libsUpgrade dhclient | Apr 27, 2020 | Nov 1, 2019 |
| Centos_linux | — | Upgrade dhcp-server-debuginfoUpgrade dhcp-develUpgrade dhclientUpgrade dhcp-commonUpgrade dhcp-libsUpgrade dhcp-libs-debuginfoUpgrade dhcp-serverUpgrade dhcp-relay-debuginfoUpgrade dhcp-client-debuginfoUpgrade dhcp-clientUpgrade dhcp-relayUpgrade dhcp-debugsourceUpgrade dhcpUpgrade dhcp-debuginfo | Aug 28, 2019 | Aug 6, 2019 |
| Debian | — | Upgrade isc-dhcp | Jul 30, 2024 | Nov 1, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade dhcpUpgrade dhclientUpgrade dhcp-commonUpgrade dhcp-libs | Dec 4, 2019 | Nov 1, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade dhcpUpgrade dhclientUpgrade dhcp-commonUpgrade dhcp-libs | Dec 18, 2019 | Nov 1, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade dhcp-libsUpgrade dhclientUpgrade dhcp-commonUpgrade dhcp | Nov 19, 2019 | Nov 1, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dhcp-serverUpgrade dhcp-libsUpgrade dhcp-clientUpgrade dhcp-commonUpgrade dhcp-relay | Nov 19, 2019 | Nov 1, 2019 |
| Oracle_linux | — | Upgrade dhcp-clientUpgrade dhcp-serverUpgrade dhcp-develUpgrade dhclientUpgrade dhcp-relayUpgrade dhcp-libsUpgrade dhcp-commonUpgrade dhcp | Jul 21, 2020 | Jul 14, 2018 |
| Redhat_linux | — | No solution existsUpgrade dhcp-server-debuginfoUpgrade dhcp-develUpgrade dhcp-commonUpgrade dhcp-debuginfoUpgrade dhcp-client-debuginfoUpgrade dhclientUpgrade dhcp-debugsourceUpgrade dhcp-libsUpgrade dhcpUpgrade dhcp-relayUpgrade dhcp-clientUpgrade dhcp-relay-debuginfoUpgrade dhcp-libs-debuginfoUpgrade dhcp-server | Aug 7, 2019 | Aug 6, 2019 |
| Suse | — | Upgrade dhcp-clientUpgrade dhcp-serverUpgrade dhcp-develUpgrade dhcp-docUpgrade dhcp-relayUpgrade dhcp | Oct 22, 2019 | Oct 22, 2019 |
| Ubuntu | — | Upgrade isc-dhcp-server | Aug 5, 2020 | May 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub