CVE-2015-8605 Denial of service in n/a
Remote attackers can crash the ISC DHCP server by sending a malformed UDP IPv4 packet with an invalid length field.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-8605?
CVE-2015-8605 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 14 Jan 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.
Weakness: CWE-20
Which versions are affected by CVE-2015-8605?
It affects 4 products.
Linux distribution packages (17)
dhcp SUSE:Linux Enterprise Desktop 11 SP3 | All versions | 4.2.4.P2-0.24.1 |
dhcp SUSE:Linux Enterprise Desktop 11 SP4 | All versions | 4.2.4.P2-0.24.1 |
dhcp SUSE:Linux Enterprise Desktop 12 | All versions | 4.2.6-14.3.1 |
dhcp SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 4.3.3-4.1 |
dhcp SUSE:Linux Enterprise Server 11 SP3 | All versions | 4.2.4.P2-0.24.1 |
dhcp SUSE:Linux Enterprise Server 11 SP3-TERADATA | All versions | 4.2.4.P2-0.24.1 |
dhcp SUSE:Linux Enterprise Server 11 SP4 | All versions | 4.2.4.P2-0.24.1 |
dhcp SUSE:Linux Enterprise Server 12 | All versions | 4.2.6-14.3.1 |
dhcp SUSE:Linux Enterprise Server 12 SP1 | All versions | 4.3.3-4.1 |
dhcp SUSE:Linux Enterprise Server for SAP Applications 11 SP3 | All versions | 4.2.4.P2-0.24.1 |
dhcp SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 4.2.4.P2-0.24.1 |
dhcp SUSE:Linux Enterprise Server for SAP Applications 12 | All versions | 4.2.6-14.3.1 |
dhcp SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 4.3.3-4.1 |
dhcp SUSE:Linux Enterprise Software Development Kit 11 SP3 | All versions | 4.2.4.P2-0.24.1 |
dhcp SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 4.2.4.P2-0.24.1 |
dhcp SUSE:Linux Enterprise Software Development Kit 12 | All versions | 4.2.6-14.3.1 |
dhcp SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 4.3.3-4.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Isc Dhcp, Sophos Unified Threat Management Up2date.
How do I fix CVE-2015-8605?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2015-8605 being exploited?
There is no known exploitation of CVE-2015-8605 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2015-8605, DLA-385-1, DLA-385-2, DSA-3442-1, GHSA-fpv7-2967-vrc5, MGASA-2016-0028 and 5 more.