Description
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | isc-dhcp | 4.2.2-1 | — |
| Debian 12 | isc-dhcp | 4.2.2-1 | — |
| Debian 6.0 | isc-dhcp | 4.1.1-P1-15+squeeze3 | DSA-2292-1 |
| Debian 5.0 | dhcp3 | 3.1.1-6+lenny6 | DSA-2292-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | dhcp +2 | 12:4.1.1-19.P1.el6_1.1 | RHSA-2011:1160 |
| RHEL 5 | dhcp +4 | 12:3.0.5-29.el5_7.1 | RHSA-2011:1160 |
| RHEL 4 | dhcp +2 | 7:3.0.1-68.el4 | RHSA-2011:1160 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dhcp | 4.3.3.P1-3.1 | openSUSE-SU-2024:10358-1 |
Advisories 3
- RHSA-2011:1160 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2292-1 isc-dhcp - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10358-1 dhcp-4.3.3.P1-3.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- USN-1190-1 vendor-advisory
- FEDORA-2011-10705 vendor-advisory
- 45595 third-party-advisory
- openSUSE-SU-2011:1021 vendor-advisory
- DSA-2292 vendor-advisory
- RHSA-2011:1160 vendor-advisory
- 1025918 vdb-entry
- 45817 third-party-advisory
- 49120 vdb-entry
- http://www.isc.org/files/release-notes/DHCP%204.1-ESV-R3.html
- http://www.isc.org/files/release-notes/DHCP%203.1-ESV-R3_0.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- 45582 third-party-advisory
- https://bugzilla.redhat.com/attachment.cgi?id=517665&action=diff
- 45918 third-party-advisory
- http://www.isc.org/software/dhcp/advisories/cve-2011-2748
- GLSA-201301-06 vendor-advisory
- http://www.isc.org/files/release-notes/DHCP%204.2.2_0.html
- 45639 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=729382
- 45629 third-party-advisory
- SUSE-SU-2011:1023 vendor-advisory
- MDVSA-2011:128 vendor-advisory
- 46780 third-party-advisory