Vulnerability in Isc Dhcpd
CVE-2019-6470
There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.088 (95.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.088 · newest: 0.088 · change: 0.000
Affected products
- Isc Dhcpd
- Multiple, Non-Isc Dhcpd — versions builds not wholly from ISC source < 4.4.1
- openSUSE Leap — versions 15.0, 15.1
- Red Hat Enterprise Linux — versions 8.0
- Red Hat Enterprise Linux Desktop — versions 7.0
- Red Hat Enterprise Linux Eus — versions 8.1, 8.2, 8.4
- Red Hat Enterprise Linux For Arm 64 — versions 8.0
- Red Hat Enterprise Linux For Arm 64 Eus — versions 8.1_aarch64, 8.2_aarch64, 8.4_aarch64
- Red Hat Enterprise Linux For IBM Z Systems — versions 7.0, 8.0
- Red Hat Enterprise Linux For IBM Z Systems Eus — versions 8.1_s390x, 8.2_s390x, 8.4_s390x
Public proof-of-concept exploits
References
- access.redhat.com/errata/RHSA-2019:2060 (Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00049.html (Mailing List, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00048.html (Mailing List, Third Party Advisory)
- bugs.debian.org/cgi-bin/bugreport.cgi (Exploit, Mailing List, Third Party Advisory)
- access.redhat.com/errata/RHSA-2019:3525 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-6470?
- CVE-2019-6470 is a medium-severity vulnerability in Isc Dhcpd. CVSS score: 6.5/10. Published 2019-11-01.
- How severe is CVE-2019-6470?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2019-6470 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.