Vulnerability-Lookup - Search a vulnerability

Vulnerabilites related to ics - kea

CVE-2019-6473 (GCVE-0-2019-6473)

Vulnerability from cvelistv5

Published

2019-10-16 17:22

Modified

2024-09-16 22:30

Severity ?

6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

An attacker who is able to deliberately exploit this vulnerability can cause the kea-dhcp4 server to stop executing, resulting in denial of service to clients. Only the DHCPv4 service is affected by this vulnerability.

Summary

An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

References

▼	URL	Tags
	https://kb.isc.org/docs/cve-2019-6473	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	ISC	Kea	Version: 1.4.0 to 1.5.0 Version: 1.6.0-beta1 Version: 1.6.0-beta2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:23:20.955Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.isc.org/docs/cve-2019-6473"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kea",
          "vendor": "ISC",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0 to 1.5.0"
            },
            {
              "status": "affected",
              "version": "1.6.0-beta1"
            },
            {
              "status": "affected",
              "version": "1.6.0-beta2"
            }
          ]
        }
      ],
      "datePublic": "2019-08-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An attacker who is able to deliberately exploit this vulnerability can cause the kea-dhcp4 server to stop executing, resulting in denial of service to clients.  Only the DHCPv4 service is affected by this vulnerability.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-16T17:22:16",
        "orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
        "shortName": "isc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.isc.org/docs/cve-2019-6473"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to a version of Kea containing a fix, available via\n   https://www.isc.org/downloads.\n\n   -  Kea 1.4.0-P2\n   -  Kea 1.5.0-P1\n   -  Kea 1.6.0"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate",
      "x_generator": {
        "engine": "Vulnogram 0.0.8"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-officer@isc.org",
          "DATE_PUBLIC": "2019-08-28T21:08:49.000Z",
          "ID": "CVE-2019-6473",
          "STATE": "PUBLIC",
          "TITLE": "A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Kea",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.4.0 to 1.5.0"
                          },
                          {
                            "version_value": "1.6.0-beta1"
                          },
                          {
                            "version_value": "1.6.0-beta2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ISC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.8"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "An attacker who is able to deliberately exploit this vulnerability can cause the kea-dhcp4 server to stop executing, resulting in denial of service to clients.  Only the DHCPv4 service is affected by this vulnerability."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.isc.org/docs/cve-2019-6473",
              "refsource": "CONFIRM",
              "url": "https://kb.isc.org/docs/cve-2019-6473"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Upgrade to a version of Kea containing a fix, available via\n   https://www.isc.org/downloads.\n\n   -  Kea 1.4.0-P2\n   -  Kea 1.5.0-P1\n   -  Kea 1.6.0"
          }
        ],
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
    "assignerShortName": "isc",
    "cveId": "CVE-2019-6473",
    "datePublished": "2019-10-16T17:22:16.730038Z",
    "dateReserved": "2019-01-16T00:00:00",
    "dateUpdated": "2024-09-16T22:30:41.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd