Skip to content
OpenAdvisories
Medium ALAS2-2018-963 1 CVE

Moderate: dhcp security update (Amazon Linux 2)

Published Feb 20, 2018 · Updated Feb 21, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-3144: It was found that the DHCP daemon did not properly clean up closed OMAPI connections in certain cases. A remote attacker able to connect to the OMAPI port could use this flaw to exhaust file descriptors in the DHCP daemon, leading to a denial of service in the OMAPI functionality. 1522918: CVE-2017-3144 dhcp: omapi code doesn't free socket descriptors when empty message is received allowing denial-of-service

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 dhclient 12:4.2.5-58.amzn2.1.2
Amazon Linux · 2 dhcp 12:4.2.5-58.amzn2.1.2
Amazon Linux · 2 dhcp-common 12:4.2.5-58.amzn2.1.2
Amazon Linux · 2 dhcp-debuginfo 12:4.2.5-58.amzn2.1.2
Amazon Linux · 2 dhcp-devel 12:4.2.5-58.amzn2.1.2
Amazon Linux · 2 dhcp-libs 12:4.2.5-58.amzn2.1.2

Vulnerabilities 1

  • Medium 5.3
    CVE-2017-3144 EPSS 73%

    Failure to properly clean up closed OMAPI connections can exhaust available sockets

    A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions ma…

    ISC ISC DHCP isc-dhcp isc-dhcp Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-3144.html