CVE-2019-6474 Vulnerability Details

  /     /     /  

CVE-2019-6474 Metadata Quick Info

CVE Published: 16/10/2019 | CVE Updated: 16/09/2024 | CVE Year: 2019
Source: isc | Vendor: ISC | Product: Kea
Status : PUBLISHED

---

CVE-2019-6474 Description

A missing check on incoming client requests can be exploited to cause a situation where the Kea server\'s lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2

Metrics

CVSS Version: 3.1 | Base Score: 5.7 MEDIUM
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* ADJACENT_NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* REQUIRED
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* NONE
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: Only Kea servers which use memfile storage for leases are affected by this vulnerability. An attacker can exploit the missing check to deliberately create a situation where the server will not restart properly should it stop for any reason.
Source: ISC

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).