CVE-2019-6473 - Vulnerability Details - OpenCVE

An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00499.

Key SSVC decision points have not yet been added.

Vendors	Products
Ics	Kea

Configuration 1 [-]

OR	cpe:2.3:a:ics:kea::::::::
	cpe:2.3:a:ics:kea:1.6.0:beta1::::::
	cpe:2.3:a:ics:kea:1.6.0:beta2::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2019-16033	An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
Ubuntu USN	USN-7759-1	Kea DHCP vulnerabilities

Fixes

Solution

Upgrade to a version of Kea containing a fix, available via https://www.isc.org/downloads. - Kea 1.4.0-P2 - Kea 1.5.0-P1 - Kea 1.6.0

Workaround

No workaround given by the vendor.

References

Link	Providers
https://kb.isc.org/docs/cve-2019-6473

History

No history.

MITRE

Status: PUBLISHED

Assigner: isc

Published: 2019-10-16T17:22:16.730038Z

Updated: 2024-09-16T22:30:41.265Z

Reserved: 2019-01-16T00:00:00

Link: CVE-2019-6473

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-10-16T18:15:37.123

Modified: 2024-11-21T04:46:31.120

Link: CVE-2019-6473

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Kea", "vendor": "ISC", "versions": [{"status": "affected", "version": "1.4.0 to 1.5.0"}, {"status": "affected", "version": "1.6.0-beta1"}, {"status": "affected", "version": "1.6.0-beta2"}]}], "datePublic": "2019-08-28T00:00:00", "descriptions": [{"lang": "en", "value": "An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "An attacker who is able to deliberately exploit this vulnerability can cause the kea-dhcp4 server to stop executing, resulting in denial of service to clients. Only the DHCPv4 service is affected by this vulnerability.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-10-16T17:22:16", "orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://kb.isc.org/docs/cve-2019-6473"}], "solutions": [{"lang": "en", "value": "Upgrade to a version of Kea containing a fix, available via\n https://www.isc.org/downloads.\n\n - Kea 1.4.0-P2\n - Kea 1.5.0-P1\n - Kea 1.6.0"}], "source": {"discovery": "INTERNAL"}, "title": "A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate", "x_generator": {"engine": "Vulnogram 0.0.8"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-officer@isc.org", "DATE_PUBLIC": "2019-08-28T21:08:49.000Z", "ID": "CVE-2019-6473", "STATE": "PUBLIC", "TITLE": "A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Kea", "version": {"version_data": [{"version_value": "1.4.0 to 1.5.0"}, {"version_value": "1.6.0-beta1"}, {"version_value": "1.6.0-beta2"}]}}]}, "vendor_name": "ISC"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2."}]}, "generator": {"engine": "Vulnogram 0.0.8"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "An attacker who is able to deliberately exploit this vulnerability can cause the kea-dhcp4 server to stop executing, resulting in denial of service to clients. Only the DHCPv4 service is affected by this vulnerability."}]}]}, "references": {"reference_data": [{"name": "https://kb.isc.org/docs/cve-2019-6473", "refsource": "CONFIRM", "url": "https://kb.isc.org/docs/cve-2019-6473"}]}, "solution": [{"lang": "en", "value": "Upgrade to a version of Kea containing a fix, available via\n https://www.isc.org/downloads.\n\n - Kea 1.4.0-P2\n - Kea 1.5.0-P1\n - Kea 1.6.0"}], "source": {"discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T20:23:20.955Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://kb.isc.org/docs/cve-2019-6473"}]}]}, "cveMetadata": {"assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "assignerShortName": "isc", "cveId": "CVE-2019-6473", "datePublished": "2019-10-16T17:22:16.730038Z", "dateReserved": "2019-01-16T00:00:00", "dateUpdated": "2024-09-16T22:30:41.265Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ics:kea:*:*:*:*:*:*:*:*", "matchCriteriaId": "42BBD24A-6295-4477-AE2C-44BFCE0E9700", "versionEndIncluding": "1.5.0", "versionStartIncluding": "1.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ics:kea:1.6.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "E5BCF666-37D1-47D3-AB1C-C105F0619E35", "vulnerable": true}, {"criteria": "cpe:2.3:a:ics:kea:1.6.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "CEB9B85C-8B6E-4808-9685-ABBB9A698FE1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2."}, {"lang": "es", "value": "Una opci\u00f3n de nombre de host no v\u00e1lido puede desencadenar un fallo de aserci\u00f3n en el proceso del servidor Kea DHCPv4 (kea-dhcp4), causando que el proceso del servidor se cierre. Versiones afectadas: 1.4.0 hasta 1.5.0, 1.6.0-beta1 y 1.6.0-beta2."}], "id": "CVE-2019-6473", "lastModified": "2024-11-21T04:46:31.120", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-officer@isc.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-16T18:15:37.123", "references": [{"source": "security-officer@isc.org", "tags": ["Vendor Advisory"], "url": "https://kb.isc.org/docs/cve-2019-6473"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://kb.isc.org/docs/cve-2019-6473"}], "sourceIdentifier": "security-officer@isc.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "nvd@nist.gov", "type": "Primary"}]}