#VU33368 Input validation error in kea - CVE-2019-6474

Vulnerability identifier: #VU33368

Vulnerability risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-6474

CWE-ID: CWE-20

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
kea

Vendor: ISC

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2

Mitigation
Install update from vendor's website.

Vulnerable software versions

kea: 1.6.0

---

External links
https://kb.isc.org/docs/cve-2019-6474

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.