Vulnerability Details : CVE-2017-3144
A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.
Products affected by CVE-2017-3144
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:*:*:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:*:*:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:-:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r2:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r3:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r3_b1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r4:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r5:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r5_b1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r5_rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r5_rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r6:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r10:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r10_b1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r11_b1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r11_rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r11_rc2:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r12:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r12_b1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r7:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r8:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r8_b1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r8_rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r9:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r9_b1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r9_rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r10_rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r11:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r12_p1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r13:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r13_b1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r14:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r14_b1:*:*:*:*:*:*
- cpe:2.3:a:isc:dhcp:4.1-esv:r15:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-3144
14.39%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-3144
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
3.9
|
1.4
|
Internet Systems Consortium (ISC) | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2017-3144
-
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-3144
-
http://www.securitytracker.com/id/1040194
ISC DHCP OMAPI Connection Management Flaw Lets Remote Users Consume Excessive Socket Descriptors on the Target System - SecurityTrackerThird Party Advisory;VDB Entry
-
https://access.redhat.com/errata/RHSA-2018:0158
RHSA-2018:0158 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://usn.ubuntu.com/3586-1/
USN-3586-1: DHCP vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://kb.isc.org/docs/aa-01541
CVE-2017-3144: Failure to properly clean up closed OMAPI connections can exhaust available sockets - Security AdvisoriesVendor Advisory
-
https://www.debian.org/security/2018/dsa-4133
Debian -- Security Information -- DSA-4133-1 isc-dhcpThird Party Advisory
-
http://www.securityfocus.com/bid/102726
ISC DHCP CVE-2017-3144 Remote Denial of Service VulnerabilityThird Party Advisory;VDB Entry
Jump to