Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2017-3144

Опубликовано: 07 дек. 2017
Источник: redhat
CVSS3: 5.3
EPSS Средний

Описание

A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.

It was found that the DHCP daemon did not properly clean up closed OMAPI connections in certain cases. A remote attacker able to connect to the OMAPI port could use this flaw to exhaust file descriptors in the DHCP daemon, leading to a denial of service in the OMAPI functionality.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 5dhcpNot affected
Red Hat Enterprise Linux 6dhcpNot affected
Red Hat Enterprise Linux 7dhcpFixedRHSA-2018:015825.01.2018

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-772
https://bugzilla.redhat.com/show_bug.cgi?id=1522918dhcp: omapi code doesn't free socket descriptors when empty message is received allowing denial-of-service

EPSS

Процентиль: 95%
0.18134
Средний

5.3 Medium

CVSS3

Связанные уязвимости

CVSS3: 7.5
ubuntu
почти 7 лет назад

A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.

CVSS3: 7.5
nvd
почти 7 лет назад

A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.

CVSS3: 7.5
debian
почти 7 лет назад

A vulnerability stemming from failure to properly clean up closed OMAP ...

suse-cvrf
больше 7 лет назад

Security update for dhcp

suse-cvrf
больше 7 лет назад

Security update for dhcp

EPSS

Процентиль: 95%
0.18134
Средний

5.3 Medium

CVSS3

Уязвимость CVE-2017-3144