CVE-2021-25217
published 2021-05-26CVE-2021-25217: In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the…
PriorityP339high7.4CVSS 3.1
AVAACLPRNUINSCCNINAH
EPSS
6.12%
92.6th percentile
In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | isc-dhcp | < isc-dhcp 4.4.1-2.3 (bookworm) | isc-dhcp 4.4.1-2.3 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| isc | dhcp | — | — |
| isc | dhcp | 4.4.0 – 4.4.2 | — |
| isc | isc_dhcp | >= 4.1 ESV < 4.1-ESV-R16-P1 | 4.1-ESV-R16-P1 |
| isc | isc_dhcp | >= 4.4 < 4.4.2-P1 | 4.4.2-P1 |
| msrc | cbl2_dhcp_4.4.2-4_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_dhcp_4.4.2-2_on_cbl_mariner_1.0 | — | — |
| paloalto | pan-os | — | — |
| siemens | ruggedcom_rox_mx5000_firmware | >= 2.3.0 < 2.15.0 | 2.15.0 |
| siemens | ruggedcom_rox_rx1400_firmware | < 2.15.0 | 2.15.0 |
| siemens | ruggedcom_rox_rx1500_firmware | >= 2.3.0 < 2.15.0 | 2.15.0 |
| siemens | ruggedcom_rox_rx1501_firmware | >= 2.3.0 < 2.15.0 | 2.15.0 |
| siemens | ruggedcom_rox_rx1510_firmware | >= 2.3.0 < 2.15.0 | 2.15.0 |
| siemens | ruggedcom_rox_rx1511_firmware | >= 2.3.0 < 2.15.0 | 2.15.0 |
| siemens | ruggedcom_rox_rx1512_firmware | >= 2.3.0 < 2.15.0 | 2.15.0 |
| siemens | ruggedcom_rox_rx1524_firmware | < 2.15.0 | 2.15.0 |
| siemens | ruggedcom_rox_rx1536_firmware | < 2.15.0 | 2.15.0 |
| siemens | ruggedcom_rox_rx5000_firmware | >= 2.3.0 < 2.15.0 | 2.15.0 |
| siemens | sinec_ins | < 1.0 | 1.0 |
| siemens | sinec_ins | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv2.03.3LOWAV:A/AC:L/Au:N/C:N/I:N/A:P
osv7.4HIGH
vendor_debian7.4HIGH
vendor_msrc7.4HIGH
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
CISA ICS
Siemens SINEC INS
cisa_ics·2022-09-15·CVSS 7.8
[HIGH] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedSeptember 15, 2022
Alert CodeICSA-22-258-05
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Exploitable remotely/Low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerabilities: Improper Input Validation, Integer Overflow or Wraparound, Uncontrolled Resource Consumption, Command Injection, Inadequate Encryption Strength, Missing Encryption of Sensitive Data, Improper Restriction of Operations Within the Bounds of a Memory Buffer, Exposure of Private Personal Information to an Unauthorized Actor, Open Redirect, Improper Resour
Ubuntu
DHCP vulnerability
vendor_ubuntu·2021-05-27
CVE-2021-25217 DHCP vulnerability
Title: DHCP vulnerability
Summary: DHCP could be made to crash if it received specially crafted network
traffic.
USN-4969-1 fixed a vulnerability in DHCP. This update provides
the corresponding update for Ubuntu 14.04 ESM and 16.04 ESM.
Original advisory details:
Jon Franklin and Pawel Wieczorkiewicz discovered that DHCP incorrectly
handled lease file parsing. A remote attacker could possibly use this issue
to cause DHCP to crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
DHCP vulnerability
vendor_ubuntu·2021-05-27
CVE-2021-25217 DHCP vulnerability
Title: DHCP vulnerability
Summary: DHCP could be made to crash if it received specially crafted network
traffic.
Jon Franklin and Pawel Wieczorkiewicz discovered that DHCP incorrectly
handled lease file parsing. A remote attacker could possibly use this issue
to cause DHCP to crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient
vendor_redhat·2021-05-26·CVSS 7.4
CVE-2021-25217 [HIGH] CWE-119 dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient
dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient
In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong
Microsoft
A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient
vendor_msrc·2021-05-11·CVSS 7.4
CVE-2021-25217 [HIGH] A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient
A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
isc: isc
Customer Action Required: Yes
Debian
CVE-2021-25217: isc-dhcp - In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches o...
vendor_debian·2021·CVSS 7.4
CVE-2021-25217 [HIGH] CVE-2021-25217: isc-dhcp - In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches o...
In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is
GHSA
GHSA-pf98-cx5w-r49r: In ISC DHCP 4
ghsa_unreviewed·2022-05-24
CVE-2021-25217 [HIGH] CWE-119 GHSA-pf98-cx5w-r49r: In ISC DHCP 4
In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is
OSV
CVE-2021-25217: In ISC DHCP 4
osv·2021-05-26·CVSS 7.4
CVE-2021-25217 [HIGH] CVE-2021-25217: In ISC DHCP 4
In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2021/05/26/6https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdfhttps://kb.isc.org/docs/cve-2021-25217https://lists.debian.org/debian-lts-announce/2021/06/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/https://security.gentoo.org/glsa/202305-22https://security.netapp.com/advisory/ntap-20220325-0011/http://www.openwall.com/lists/oss-security/2021/05/26/6https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdfhttps://kb.isc.org/docs/cve-2021-25217https://lists.debian.org/debian-lts-announce/2021/06/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/https://security.gentoo.org/glsa/202305-22https://security.netapp.com/advisory/ntap-20220325-0011/
2021-05-26
Published