There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade dhcpUpgrade bind | Mar 26, 2024 | Nov 1, 2019 |
| Amazon Linux Ami 2 | — | Upgrade dhcp-libsUpgrade dhclientUpgrade dhcpUpgrade dhcp-debuginfoUpgrade dhcp-develUpgrade dhcp-common | Apr 27, 2020 | Nov 1, 2019 |
| Centos_linux | — | Upgrade dhcp-relay-debuginfoUpgrade dhcp-debuginfoUpgrade dhcp-serverUpgrade dhcp-relayUpgrade dhcp-client-debuginfoUpgrade dhcp-clientUpgrade dhcp-debugsourceUpgrade dhcpUpgrade dhcp-libs-debuginfoUpgrade dhcp-libsUpgrade dhcp-commonUpgrade dhcp-server-debuginfoUpgrade dhcp-develUpgrade dhclient | Aug 28, 2019 | Aug 6, 2019 |
| Debian | — | Upgrade isc-dhcp | Jul 30, 2024 | Nov 1, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade dhcp-libsUpgrade dhclientUpgrade dhcp-commonUpgrade dhcp | Dec 4, 2019 | Nov 1, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade dhcp-libsUpgrade dhcpUpgrade dhclientUpgrade dhcp-common | Dec 18, 2019 | Nov 1, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade dhcp-libsUpgrade dhclientUpgrade dhcp-commonUpgrade dhcp | Nov 19, 2019 | Nov 1, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dhcp-relayUpgrade dhcp-clientUpgrade dhcp-libsUpgrade dhcp-commonUpgrade dhcp-server | Nov 19, 2019 | Nov 1, 2019 |
| Oracle_linux | — | Upgrade dhcp-develUpgrade dhcpUpgrade dhclientUpgrade dhcp-relayUpgrade dhcp-libsUpgrade dhcp-serverUpgrade dhcp-commonUpgrade dhcp-client | Jul 21, 2020 | Jul 14, 2018 |
| Redhat_linux | — | Upgrade dhcp-clientUpgrade dhcp-relay-debuginfoUpgrade dhcp-libs-debuginfoUpgrade dhcp-serverUpgrade dhcp-relayUpgrade dhcp-libsUpgrade dhcpUpgrade dhcp-develUpgrade dhclientUpgrade dhcp-client-debuginfoUpgrade dhcp-debugsourceUpgrade dhcp-debuginfoUpgrade dhcp-server-debuginfoNo solution existsUpgrade dhcp-common | Aug 7, 2019 | Aug 6, 2019 |
| Suse | — | Upgrade dhcp-relayUpgrade dhcpUpgrade dhcp-serverUpgrade dhcp-clientUpgrade dhcp-docUpgrade dhcp-devel | Oct 22, 2019 | Oct 22, 2019 |
| Ubuntu | — | Upgrade isc-dhcp-server | Aug 5, 2020 | May 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub