CVE-2016-2774

Priority
Description
ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not
restrict the number of concurrent TCP sessions, which allows remote
attackers to cause a denial of service (INSIST assertion failure or
request-processing outage) by establishing many sessions.
Notes
mdeslaurDoS over OMAPI and failover ports only, see ISC kb article
for workarounds, or properly limit access to ports
Package
Upstream:released (4.3.4)
Ubuntu 12.04 ESM (Precise Pangolin):needed
Ubuntu 14.04 ESM (Trusty Tahr):released (4.2.4-7ubuntu12.12)
Ubuntu 16.04 LTS (Xenial Xerus):released (4.3.3-5ubuntu12.9)
Ubuntu 18.04 LTS (Bionic Beaver):not-affected (4.3.5-3ubuntu2)
Ubuntu 20.04 LTS (Focal Fossa):not-affected (4.3.5-3ubuntu2)
Ubuntu 20.10 (Groovy Gorilla):not-affected (4.3.5-3ubuntu2)
Patches:
Upstream:https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commit;h=0b209ea5cc333255e055113fa2ad636dda681a21
More Information

Updated: 2020-09-09 20:48:06 UTC (commit b67d7d8b03f173f825cd706df5bd078bca500b0e)